Xfence ("Xfence", "we", "us", "our") is a security testing platform engineered by Vrseclabs. This Privacy Policy explains what information we collect when you use our website and platform (together, the "Service"), how we use it, and the choices you have.
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.
On this page
1. Information We Collect
We collect information in three ways: what you give us directly, what's generated by using the platform, and what we receive automatically from your browser.
Account & Application Information
- Name, username, email address, and password (stored as a salted hash, never in plain text)
- For organizations: company name, website, company size, and industry
- For researchers: full legal name, LinkedIn profile, public profile links, bio, and self-reported skillsets
- Signup request details you submit when requesting access to the platform
Engagement & Report Data
- Engagement scope, do's and don'ts, dates, and target assets published for an organization
- For researchers: the terms and NDA you sign for each engagement, with your typed name, the time, your IP address and a fingerprint of the signed text
- Vulnerability reports, reproduction steps, proof-of-concept material, and comments submitted through the platform
- Triage decisions and report status
Automatically Collected Information
- Log data such as IP address, browser type, device information, and timestamps
- Authentication tokens stored in your browser's local storage to keep you signed in
- Information from third-party widgets embedded on our site (see our Cookie Policy)
2. How We Use Your Information
- To create and administer your account, and to verify researcher applications
- To operate the core Service — assigning researchers to engagements, keeping signed agreements, routing reports, and facilitating communication between organizations and researchers
- To send transactional emails (invite links, assignments, new report and comment notifications) and, where permitted, occasional product updates
- To monitor, secure, and improve the Service, including detecting abuse or out-of-scope testing
- To comply with legal obligations and enforce our Terms of Service
3. Legal Basis for Processing
Where applicable data protection law requires a legal basis, we rely on: performance of a contract (providing the Service you signed up for), our legitimate interests (platform security, fraud prevention, and service improvement), your consent (e.g. optional marketing communications), and compliance with legal obligations.
4. How We Share Information
We do not sell your personal information. We share information only in the following circumstances:
- Within a scoped engagement — organizations see the researcher's profile and reports submitted to their program; researchers see only the scope and assets of programs they've been granted access to. Programs are private and invite-only by default.
- Service providers — we use third parties for infrastructure, email delivery, scheduling (Cal.com), and form collection (Tally), each bound by their own privacy terms
- Legal & safety — where required by law, to enforce our terms, or to protect the rights, property, or safety of Xfence, our users, or the public
- Business transfers — in connection with a merger, acquisition, or sale of assets, subject to standard confidentiality protections
5. Data Retention
We retain account and engagement data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or reporting obligations, resolve disputes, and enforce our agreements. You may request deletion of your account as described in Your Rights below.
6. Data Security
We use industry-standard safeguards — including hashed passwords, signed authentication tokens, and access-scoped APIs — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security, but we work continuously to protect the platform against unauthorized access, alteration, disclosure, or destruction.
7. Your Rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Request deletion of your account and associated personal information
- Object to or restrict certain processing
- Request a portable copy of your data
To exercise any of these rights, contact us using the details in Contact Us. We may need to verify your identity before acting on a request.
8. International Data Transfers
Xfence may process and store data in countries other than your own. Where we transfer personal data internationally, we take steps to ensure it receives an adequate level of protection consistent with applicable data protection law.
9. Children's Privacy
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you directly. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.
11. Contact Us
Questions about this Privacy Policy or your data? Reach us at security@vrseclabs.in.