Data handling
What Vulnio keeps, and for how long
This page adds the Vulnio specifics to the Talivio privacy policy. Controller: Talivio Technology OÜ, Tallinn, Estonia.
talivio.com/privacy · Data processing agreement · Acceptable use
Uploaded files
An uploaded SBOM or lock file is read in memory and not stored. Vulnio keeps the component ecosystem, name, version and package URL, and the vulnerabilities matched to them.
One-off scans
A scan without a plan is kept for 30 days so that its link works, then deleted with its components and results. To limit abuse, a keyed hash of your IP address, which changes every day, is stored with the scan and deleted with it.
Accounts and subscribers
Account data (name, e-mail, language, password hash), the products you monitor and their component lists, the incident records and the security page you publish are kept until you delete them or your account. Deleting the account deletes them.
Who else is involved
OSV.dev (operated by Google) receives component names and versions to look up vulnerabilities; no account or IP data is sent. The CISA and ENISA lists are downloaded; nothing is sent to them. Payments are handled by Stripe through Talivio Pay. E-mail is sent from Talivio's own mail server. Hosting: Contabo GmbH, data centre in the EU.
Analytics
Page views and a few events (scope check finished, scan run, sign-up, purchase) are counted by Talivio's own cookieless tracker. No advertising tags are used.
Your rights
You can ask for access, correction or deletion at [email protected]. Business customers can rely on the Talivio data processing agreement.