Privacy and cookies

Two roles

For visitors, people who ask for a scan and account holders, Dembri Technologies Ltd (DIFC) is the controller of their personal data.

For the documents, code and website content a customer connects for an assessment, the customer is the controller. We act as their processor and follow their instructions.

What we collect and why

Public pages

Our web server records technical request logs (network address, time, page) to keep the service secure and to fix errors. Web server logs keep addresses for 14 days. Lawful basis: our legitimate interest in running a secure service.

Scan requests

Name, work email, company, website and your optional message, to answer your request and, if you go ahead, to set up access. A scan request stores a keyed hash of your network address, not the address itself, to limit abuse. Lawful basis: your consent, which you give on the form.

Accounts

Name, email, role, a password hash and sign in records, to give you access and protect your account. Lawful basis: our legitimate interests in providing the service your organisation chose and keeping it secure. Our contract is with your organisation.

Alerts

We email account holders when something waits for them. The email names the engagement and the event, not its content. Lawful basis: our legitimate interests in providing the service your organisation chose. You can switch alerts off in your account settings.

Assessment content

What a customer connects for an assessment. We redact personal data we detect in excerpts before storing them. We process this content as the customer's processor.

Where we keep it

We store data mainly on our server at Hetzner Online GmbH, Falkenstein, Germany. The providers listed below also receive data for the purposes stated.

We keep a daily backup, encrypted with a key that is not stored on the server. The server keeps the last 3 backups.

How long we keep it

Scan requests

Deleted after 90 days if we do not take them forward. If we invite you, we remove your details from the request 90 days after that decision and keep only a record that an invitation was sent.

Assessment evidence and uploads

Evidence text is blanked, and uploaded files and copied code are deleted, after 90 days.

Engagements

Erased after 365 days, unless a report was approved. Approved reports are kept for 1095 days for accountability, then erased. A customer can delete an engagement at any time.

Web server logs

Rotated daily and kept for 14 days.

Your rights

You can ask to see, correct or delete your personal data, to restrict or object to its use, or to withdraw your consent. Write to asif.n@dembri.com. We reply within the time the law allows.

You can also complain to the data protection regulator that applies to you, for example the DIFC Commissioner of Data Protection.

Service providers

These providers handle personal data for us, and only for the purpose shown.

Hetzner Online GmbH (Germany)

Hosting of the server and its data.

Anthropic (United States)

AI analysis during a scan. It receives redacted excerpts only.

OpenAI (United States)

AI analysis during a scan. It receives redacted excerpts only.

Resend (United States)

Sending alert emails to account holders.

Cloudflare

Cloudflare provides DNS only; we do not use it to proxy website traffic.

When you connect a code repository, we read it from the host you choose, for example GitHub. That host is your provider, not ours.

Cookies and browser storage

We use one cookie, and only after you sign in. We use no analytics, tracking or advertising cookies, so we show no cookie banner.

Contact

Questions about this notice or your data: asif.n@dembri.com.