Controller: Hostin Technologies (EU) · contact@h0sint.com
Enter a domain you own or are authorised to assess. h0SINT will passively look up publicly available information about it — DNS records, TLS certificates, WHOIS registration data, and basic tech-stack signals. We never log in, use credentials, or access anything private. No email is required to see your results. Your scan is stored privately, is not indexed by search engines, and is only readable via the secret link you get back.
Two different things, under two different legal bases. We keep them separate on purpose.
| What | Why | Legal basis | Kept for |
|---|---|---|---|
| Assessment data about a domain — DNS, certificate, WHOIS-organisation, mail-security and tech-stack facts, open ports, and the domain's resolved IPs | To produce the assessment you asked for, and to keep the evidence behind every finding we reported to you | Legitimate interests — GDPR Art. 6(1)(f). The target is a company's public infrastructure, not a person; the lookups are passive and public | For the life of the engagement and the period in which it could be questioned — see “How long we keep an assessment”. Erased on request. |
| Your email address, if you choose to unlock the full report | To send you the complete results and, with your consent, occasional updates about h0SINT | Your consent — GDPR Art. 6(1)(a), given by submitting the unlock form | Until you ask us to delete it, or 2 years without further contact |
Your email is stored with your lead record only — it is never written into the scan report. We do not sell or share it with third parties.
We keep the raw output of an assessment, not just the report. That is a deliberate choice and you should know the reason: a security finding is only worth what its evidence is worth. If a conclusion we gave you is ever challenged — by your own team, by an auditor, by a counterparty in a transaction — the scan that produced it is the only thing that can settle the question. Discarding it on a timer would mean that six months later we could no longer show our work.
So assessment data is retained for the duration of our engagement with you, and for the period afterwards in which the work could reasonably be questioned or relied upon — in practice, the applicable limitation period. We do not sell it, we do not share it, and we never use one client's data to inform another client's report.
You can end that at any time. Ask us to erase an assessment and we delete it — the findings, the raw evidence behind them, and any report derived from it — and confirm in writing when it is done. The only thing we keep afterwards is the signed engagement letter and the domain-verification record, because those are how we demonstrate that the testing was authorised. They contain no findings.
One honest caveat, since no policy can promise otherwise: erasing our copy does not un-publish anything. Everything we collect was already publicly observable, and deleting our record does not stop anyone else looking up the same facts tomorrow.
Scans target company infrastructure, not individuals. The one place personal data can appear incidentally is a WHOIS/RDAP registrant name — most registries redact this, but a sole trader who registered a domain in their own name may still be listed. If that's you, email us and we will delete the record for that domain; it is neither profiled nor enriched, and we hold no other information about you.
We use Cloudflare Web Analytics, which is cookieless: page views and referrers only, no cross-site identifier, no advertising features, no Google product involved. This site sets no cookies at all — check your browser's developer tools, and that is also why you were never asked to dismiss a consent banner.
The application itself is private and is not part of this website. If you log into it, it sets one session cookie for login state.
On EU-hosted, encrypted infrastructure in the Netherlands, with access restricted to a private network, behind Cloudflare's edge, which terminates TLS (anonymous access logs, no long-term retention by us). Our full sub-processor list is on the Trust & Security page.
DELETE endpoint; that
endpoint was removed when we decommissioned the public self-service scanner, so the honest
route is now email.)We act on privacy requests within 30 days, and usually within 48 hours.
Hostin Technologies — contact@h0sint.com