Legal
Privacy Policy
This policy describes how Torva LLC, an Indiana limited liability company ("Torva," "we," "us"), handles information.
This policy explains what Torva collects, why, and your choices. We aim to collect as little as possible.
Information we collect
- Account information: your work email, company name, password (stored only as a secure hash), company membership and role, invitations and team-management activity. If you enable MFA, we store an encrypted authenticator secret and hashed recovery codes.
- Domains and scan data: the domains you verify, authorized Core network scopes, device and service observations (addresses, hostnames, open ports, certificate details, security headers and the software versions services report), and the results of scans we run for your company. Scans never log in to your systems or collect file contents or network traffic. Sign-off records store who verified or accepted a finding, the reason and the review date. The compliance workspace stores the assets, risks, safeguard answers and finalized risk analyses you enter, with who entered them; don’t enter patient information in it. If you import a previous HHS SRA Tool file, Torva reads it in memory and keeps only the locations, assets, vendors, answers and risks it contains; the file itself isn’t stored. Active company members can view shared reports; Owners control invitations and membership.
- Billing information: handled by Stripe. We store a customer reference and your plan status, never your card number.
- Instant check: when you run the free instant check, we process the domain you enter and public information about it to produce a result. The instant-check response is returned to your browser and is not stored as a customer scan report. Infrastructure logs may record request metadata.
- Contact form: when you send a message, we store your name, email address, company (if given), topic and message, and email them to our inbox so we can reply. We keep messages only as long as needed to handle your request and related follow-up, and you can ask us to delete them.
- Emailed instant-check reports: if you ask us to email the full instant-check result, we store your email address, the domain checked, its grade and score, when you asked, and whether you opted in to updates. We use this to send the report you requested and to limit repeated requests. Only if you opted in, we re-run the same public check about once a month and email you when the result changes. Updates stop when you unsubscribe using the link in any update or when you create a Torva account. Contact us to delete the record.
- Basic usage data: Our public marketing and learning pages use Umami, an open-source analytics tool we run on our own server, and Cloudflare Web Analytics to measure page views, referral sources, page performance and a few named steps such as running the instant check or opening the signup page. Neither service uses cookies or browser local storage to identify visitors. The analytics snippet is not installed on our account, authentication, installation or customer report pages. We do not send form entries, entered domains or scan findings to analytics as custom events.
Complete reference documents and guided reviews
Complete reference documents store scan evidence snapshots, customer-entered assessment and remediation notes, and revision/approval records identifying the company member and date. Company Owners, Admins and Viewers can read these documents; Owners and Admins with an active Complete subscription can create and update them. Saved records remain available for export after a plan change while the company account exists. Do not enter patient/customer records, passwords or secrets in these forms.
Guided reviews autosave answers and progress to the company account, recording the signed-in member and server activity dates. Pending answers may be kept in browser session storage so the same tab can recover them after a reload or temporary connection failure. This recovery copy is removed after a successful save or when the user explicitly reloads the saved review; closing the browser session can remove it. Pending answers are not guaranteed saved to the server until the interface confirms success. Do not enter sensitive patient/customer records, passwords or secrets.
Website analytics
Umami runs on infrastructure we operate, so its page-view data is not shared with an analytics vendor. Cloudflare receives browser requests for its analytics script and measurement endpoint. For information about its collection and processing, see Cloudflare Web Analytics. Analytics helps us understand which public pages are useful and how quickly they load. We do not use it for advertising profiles or cross-site tracking.
Cookies
We use a single essential cookie to keep you signed in. It is required for the Service to work and is not used for tracking or advertising. We do not use advertising or cross-site tracking cookies.
How we use information
To provide and secure the Service, run the scans you request, process payments, send service and (with your consent where required) marketing email, and comply with law. We do not sell your personal information.
Sharing
We share information only with service providers that help us operate, such as Cloudflare (public website analytics), Stripe (payments), our cloud hosting provider, Zoho (email), and Backblaze (where offsite backups are configured), under agreements that protect it, or when required by law. Scan-change alerts are sent to an opted-in member's verified chosen address. Team invitations are sent to the address entered by the Owner.
Optional help links open Google searches when you choose to use them. Reporting-profile searches contain fixed topic text. Fix-help searches may include the environment details you enter; review the search before opening it. Google receives the query and handles it under its own privacy policy.
Data retention
Account and scan data are retained to provide your account and reporting history. Full scan detail is kept for each site’s 30 most recent internal (Core) scans; older Core scans are kept as summaries (scores, counts and comparability) so progress over time stays visible. External (Edge) scans keep full detail for each host’s 24 most recent scans; older Edge scans are kept as summaries (score, counts and issue titles) for 18 months, then deleted. Edge summaries also keep which ports were open or closed, so port history stays accurate. Fix re-check results are kept for 14 days and threat alerts for one year. Sign-off records and evidence documents are kept in full. Canceling billing does not automatically delete your account or reports. Contact us to request deletion or export. Backups and records needed for security, billing or legal obligations may be retained separately.
Your rights
Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to certain processing. Email hello@torvasecurity.com and we'll respond as required by law.
Security
We protect your information with encryption in transit, hashed passwords, access controls, and the practices described on our security page. No method is perfectly secure, but we work to hold ourselves to the standard we measure others against.
Children
The Service is for businesses and is not directed to children under 16. We don't knowingly collect their information.
Contact
Questions about privacy: hello@torvasecurity.com.