Privacy Policy

Panoptes (“Panoptes”, “we”, “us”) provides software that performs authorized security testing of web applications, APIs and cloud environments on behalf of our customers. This policy applies to our marketing site at pnpts.com and the Panoptes dashboard at app.pnpts.com (together, the “Service”). For privacy questions, contact us at contact@pnpts.com.

We collect only what we need to operate the Service:

• Account information. When you create an account or sign in, we collect your name, email address, and — if you use a social sign-in — your provider account identifier and profile photo.
• Organization & usage data. The organizations you belong to, your role, settings, and logs of how you interact with the dashboard (pages viewed, actions taken, timestamps, IP address).
• Engagement data. The scope you authorize for testing (such as domains and endpoints) and the findings, evidence and reports our agents generate for you.
• Billing data. If you subscribe to a paid plan, our payment processor (Stripe) handles your card details; we receive only billing metadata such as plan, status and the last four digits of the card.

You can sign in to the Panoptes dashboard with Google or GitHub. When you do, the provider shares a limited set of profile information with us — your name, email address, profile picture and a stable account identifier — using the openid, email and profile scopes. We use this only to create and secure your Panoptes account and to identify you within your organization.

We do not request access to your repositories, contacts, calendar or any other data, and we never post or act on your behalf on Google or GitHub. Panoptes’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke our access at any time in your Google account permissions or your GitHub authorized applications.

We use personal data to:

• create your account, authenticate you, and keep the Service secure;
• deliver the Service — running authorized tests and producing findings, evidence and reports;
• operate, maintain, debug and improve the Service;
• communicate with you about your account, security and material changes to the Service;
• process payments and prevent fraud and abuse; and
• comply with legal obligations and enforce our terms.

We do not sell personal data. We share it only with service providers that help us run the Service, under contracts that limit their use of it:

• Supabase — authentication and database;
• Vercel — dashboard hosting;
• Google Cloud / Firebase — marketing-site hosting and infrastructure;
• Stripe — payment processing.

We may also disclose data if required by law, to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets, in which case we will notify you of any change in control.

We keep personal data for as long as your account is active and as needed to provide the Service. When you delete your account we delete or anonymize your personal data within a reasonable period, except where we must retain it to meet legal, accounting or security obligations.

We protect data in transit and at rest with industry-standard encryption, enforce tenant isolation so each organization can only reach its own data, and restrict internal access on a need-to-know basis. No method of transmission or storage is perfectly secure, but we work continuously to safeguard your information.

Depending on where you live, you may have the right to access, correct, export or delete your personal data, and to object to or restrict certain processing. You can exercise these rights — or revoke a social sign-in — from your account settings, or by emailing contact@pnpts.com. We will respond within the time required by applicable law.

We may process and store data in countries other than yours. Where we transfer personal data across borders, we rely on appropriate safeguards, such as standard contractual clauses, as required by applicable law.

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal data from children.

We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you through the Service. Your continued use after an update means you accept the revised policy.

Questions about this policy or your data? Email contact@pnpts.com.