Privacy Policy

KeyDrift is a product of Veristria, a Norwegian aksjeselskap (AS) under incorporation (24 August 2026), based in Norway. Veristria is the controller of the personal data described here, and its organization number goes on this page the day registration completes.

One address handles everything on this page — access, correction, deletion, or an argument about a sentence you do not believe: info@useveristria.com.

You give us a URL. We fetch that page and the JavaScript it references — including chunks named only in a route manifest — from the site and from sibling asset hosts. Only GET and HEAD requests are ever issued, and the fetch layer rejects anything else rather than trusting the call sites not to ask.

Nothing is authenticated. We send no cookies and no credentials, so we see exactly what an anonymous visitor sees and nothing behind a login. Our requests identify themselves as KeyDrift and link back to the scanner documentation, so an operator looking at their logs can tell who we are.

One row per scan: the URL you submitted, the URL we ended up at after redirects, a fingerprint of the page, the list of files we read with their status and byte counts, how long it took, whether the read was partial, and the findings.

A finding never contains a live secret. The value is masked to its first eight and last four characters — never more than half the string — and stored alongside a salted SHA-256 fingerprint. The salt is what stops the findings table becoming an oracle: an unsalted hash of a key you already hold would confirm its presence instantly. There is no column in the schema that can hold a live credential value, so there is nowhere to put one by mistake.

Reports from a URL are public. Anyone with the link can open the report, it names the site that was scanned, and search engines are allowed to index it. That is deliberate — a public report is checkable by the site owner — but it is worth knowing before you scan something sensitive.

Pasted source is not stored. If you paste code instead of giving a URL, the text itself is never written down. The report keeps the masked findings and the byte count, and it is marked private and not indexed.

Your account. Sign-in is a magic link, so we hold your email address, an account identifier, your name if you gave one, and which organization you belong to. We store no passwords, because there are none.

Alert destinations. If you set up alerts we store where to send them — an email address, a Slack or Discord webhook URL. Webhook secrets are encrypted.

Billing. Subscriptions run through Stripe. Stripe collects the card details; we never see or store a card number. What reaches us is a customer identifier, a subscription identifier, the plan, and whether the invoice was paid.

The launch list. If you give us your email for launch news we store three things: the lowercased address, a tag saying which of our sites captured it, and the timestamp. No IP, no name, no referrer. The address is never written to a log. You can unsubscribe from any message we send, or email us.

The support assistant. Where the assistant is available, the conversation goes to a third-party model provider to produce a reply, and is logged on our side so a human can pick up what it could not answer. If you give a name and an email so we can send you the transcript, those are stored with the conversation. It is labeled as an AI and will say so if you ask.

Rate limiting. Scan endpoints are limited per caller, keyed on the address the request arrives from. These are counters in memory, not logs, and they are gone within minutes.

Contract — your account, your scans and your billing records exist because you asked for the service.

Consent — the launch list and the newsletter, which you can withdraw from at any time.

Legitimate interests — keeping the scanner available and abuse under control, which is what the rate-limit counters and server logs are for.

Legal obligation — invoices and the accounting records behind them, which Norwegian law requires us to keep.

These companies process data on our behalf. We sell nothing, and we have no advertising partners.

• Vercel — hosting and delivery for this site.
• Supabase — the Postgres database and the sign-in service.
• Stripe — payments, subscriptions and the billing portal. Stripe is the controller of the card data it collects.
• OpenRouter — model inference for the support assistant. It receives the conversation text only, never account or scan records.

Alerts you configure go where you tell them to go — your inbox, your Slack, your webhook. That destination is your choice, not our processor.

Strictly necessary only: the session cookie that keeps you signed in, and the cookies Stripe sets during checkout. No advertising cookies, no analytics cookies, no cross-site tracking, and no third-party scripts on the marketing pages.

That is why there is no consent banner in front of this page. Strictly necessary cookies do not require consent and we have nothing else to ask about. If we ever ship anything that is not strictly necessary, a banner appears first and it defaults to off.

Account data and the scans belonging to it: for as long as the account exists. Delete the account and they go with it.

Scans run without an account: kept until you ask us to remove them. We have not built an automatic expiry, and we would rather tell you that than publish a retention period we do not enforce. Send us the report link and we delete it, including the public page.

Launch-list addresses: until you unsubscribe or ask us to delete them. Invoices: for the period Norwegian bookkeeping law requires, which we cannot shorten on request. Rate-limit counters: minutes.

Under the GDPR you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask for it in a portable form, object to processing based on legitimate interests, and ask us to restrict processing while something is disputed. Where we rely on consent you can withdraw it at any time.

Email info@useveristria.com and we answer within a month. No form, no fee. We will ask you to confirm you control the address in question, because handing an account’s data to whoever asks first would be its own privacy failure.

We are based in Norway and operate for the EEA. Some of the processors above are established in the United States and may process data there, covered by the transfer mechanisms those providers publish — standard contractual clauses and, where applicable, the EU–US Data Privacy Framework.

Tell us first if you can. If we do not resolve it, you can complain to the Norwegian Data Protection Authority, Datatilsynet, at datatilsynet.no, or to the supervisory authority where you live.

When the code changes, this page changes, and the date at the top moves with it. If a change materially affects what we do with data you have already given us, we tell you by email rather than quietly editing the page.