Privacy policy
Last updated: 8 August 2026
This policy explains what data Dossier processes, why, for how long, and what your rights are. The confidentiality of your engagement data is central to the product.
Data controller
The data controller is LAZO GROUP, reachable at support@dossiersec.io. A data processing agreement (DPA) is available on request for business customers.
Data we collect
We process: your e-mail address and account information; the scan files you upload (Nmap, Nessus, Trivy, Nuclei, Burp, ZAP and others); the reports generated; and usage and billing metadata. We do not request special-category data under the GDPR.
Purposes and legal basis
Your data is processed to provide the service (performance of the contract), to handle billing (legal obligation and contract), and to improve product reliability (legitimate interest). No client data is used for advertising.
Subprocessors
We rely on carefully selected subprocessors: Supabase (database, authentication, storage, European Union); Vercel (site hosting, European region); Stripe (payment processing); Anthropic (AI generation of report prose). Only already-structured finding data, never raw scan files, is sent to the AI service, and anonymisation of client identifiers can be applied beforehand.
Retention
Uploaded scan files are deleted immediately after the report is generated. Generated reports are kept for 30 days so you can download them, then permanently erased. Account data is retained while the account is active, then deleted or anonymised.
Transfers outside the EU
The core infrastructure (database, storage, hosting) is located in the European Union. The AI service used for prose (Anthropic) may process data outside the EU; this transfer is covered by appropriate safeguards (standard contractual clauses) and limited to structured, anonymisable finding data.
Security
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Access is isolated per account using row-level security: a user can only access their own reports. No client scan, finding or report is used to train a model.
Your rights
Under the GDPR you have the right to access, rectification, erasure, restriction, objection and portability. Write to support@dossiersec.io. You may also lodge a complaint with your supervisory authority (in France, the CNIL, cnil.fr).
Cookies
Dossier uses only the cookies strictly necessary for the service to work (authentication and session). No advertising cookies or third-party tracking are set.