Privacy Policy

1. Who We Are

XtraSecurity ("XtraSecurity", "we", "our", or "us") operates the XtraSecurity secrets management platform, available at xtrasecurity.com, and its associated CLI, SDK, VS Code extension, and APIs (collectively, the "Service").

For privacy enquiries, please contact our Grievance Officer:

2. Scope of this Policy

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use our Service. It applies to:

• Visitors to our website
• Registered users of the XtraSecurity dashboard
• Users of our CLI, SDK, and VS Code extension
• Customers who have purchased a subscription plan

This Policy does not apply to the content of secrets (API keys, tokens, credentials) you store in XtraSecurity. That content is encrypted under our zero-knowledge architecture and is treated as your property. See Section 6 for our cryptographic commitments.

3. Personal Data We Collect

3.1 Account & Identity Data

• Full name and email address (required for account creation)
• Profile photo (if provided via Google/GitHub OAuth)
• Hashed password (we never store plaintext passwords)
• Two-factor authentication credentials (TOTP seeds, stored encrypted)
• Company name (optional, for Pro/Enterprise plans)

Lawful basis (GDPR Art 6(1)(b)): Contract — necessary to provide the Service.

3.2 Usage & Technical Data

• IP address, browser type, operating system
• Pages visited, features used, session duration
• CLI version, Node.js version (for diagnostics and compatibility)
• API request metadata (timestamp, endpoint, response code) — not secret content
• Error logs and crash reports (anonymized where possible)

Lawful basis (GDPR Art 6(1)(f)): Legitimate interest — service performance, security, and fraud prevention.

3.3 Payment & Billing Data

• Subscription tier, billing cycle, payment history
• Invoice details (name, address, GSTIN for Indian customers)
• Card details are never stored by XtraSecurity — they are processed directly by Razorpay (PCI-DSS certified) or Stripe

Lawful basis (GDPR Art 6(1)(b) and (c)): Contract and legal obligation (GST/tax records).

3.4 Audit & Activity Logs

• Records of secret reads, writes, deletions, and role changes (by user ID)
• Team invitations sent and accepted
• Key rotation events

Lawful basis (GDPR Art 6(1)(b) and (f)): Contract (feature delivery) and legitimate interest (security integrity). Audit logs are immutable for security compliance and are pseudonymized upon account deletion requests.

3.5 Communications Data

• Support ticket messages
• Email correspondence with our team
• Feedback and feature requests

Lawful basis (GDPR Art 6(1)(b)): Contract — provision of customer support.

3.6 Data We Do NOT Collect

• The content of your secrets (API keys, tokens, passwords you store) — these are encrypted client-side and are never readable by XtraSecurity servers under Strict Zero-Knowledge mode
• Sensitive special category data under GDPR Art 9 (health, biometric, racial, religious data)
• Children's data — our Service is strictly for users aged 18 and above

4. Cookies & Tracking Technologies

We use the following types of cookies:

You can manage cookie preferences at any time via our Cookie Settings panel accessible in the website footer.

5. How We Use Your Data

• Providing, maintaining, and improving the Service
• Processing subscription payments and issuing invoices/receipts
• Sending transactional emails (account creation, password reset, invite notifications)
• Providing customer support
• Security monitoring, fraud detection, and abuse prevention
• Complying with legal obligations (tax, regulatory reporting)
• Sending product updates and newsletters (with opt-out available)

We do not sell your personal data. We do not share personal data with third parties for their direct marketing purposes.

6. Zero-Knowledge Architecture & Your Secrets

XtraSecurity operates on a strict zero-knowledge encryption model for secrets stored in Strict E2EE mode (Level 3). This means:

• Your Master Vault Passphrase is never transmitted to our servers in plaintext.
• Encryption and decryption of your secrets happens entirely locally on your device (via the CLI, SDK, VS Code extension, or WebCrypto API in the browser).
• Your Master Passphrase may be cached locally in your device's native Hardware Keyring (e.g., Windows DPAPI, macOS Keychain). We do not have access to this local hardware cache.
• Our servers store only ciphertext blobs — we mathematically cannot read, copy, or distribute your secrets.
• Absolute Non-Recovery: If you lose your Master Passphrase, we cannot recover your secrets under any circumstances, including pursuant to lawful subpoenas, as we do not possess the decryption keys.

Legacy secrets stored under Server AES (Level 1) are encrypted using a server-side key stored in our infrastructure. These are not zero-knowledge. We strongly recommend migrating to Level 3 using the Vault Key Rotation feature.

7. Data Sharing & Sub-processors

We share your data with the following third-party sub-processors who help us operate the Service:

We do not sell, rent, or otherwise disclose personal data to other parties except as listed above or where required by law (e.g., valid court order, government request).

8. International Data Transfers

XtraSecurity is headquartered in India. If you access our Service from the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data may be transferred to countries that may not provide the same level of data protection as your home country.

For such transfers, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission. You may request a copy of relevant transfer safeguards by contacting [email protected].

9. Data Retention

10. Your Rights

Depending on your location, you may have the following rights:

Under GDPR (EU/EEA/UK users):

• Right to access — Request a copy of your personal data
• Right to rectification — Correct inaccurate personal data
• Right to erasure — Request deletion of your account and personal data (except where we have legal obligations to retain it)
• Right to restriction — Request limited processing in certain circumstances
• Right to data portability — Receive your account data in a machine-readable format
• Right to object — Object to processing based on legitimate interests
• Right not to be subject to automated decision-making

Under DPDP Act 2023 (India):

• Right to access — Summary of personal data and processing activities
• Right to correction and erasure
• Right to grievance redressal — Contact our Grievance Officer
• Right to nominate — Nominate another individual to exercise rights in the event of death or incapacity

Under CCPA (California users):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale or sharing of personal information
• Right to non-discrimination for exercising CCPA rights

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You may also delete your account directly from Settings → Account → Delete Account.

11. Security Measures

• AES-256-GCM encryption for all stored secrets
• HKDF-SHA256 key derivation with per-project salts
• TLS 1.3 in transit for all API communications
• Bcrypt hashing for passwords
• Role-based access control (RBAC) on all endpoints
• IP restriction and 2FA enforcement per project
• Immutable audit logs for all sensitive operations
• Automated secret leak scanning on all git commits

In the event of a personal data breach affecting your rights and freedoms, we will notify affected users within 72 hours of becoming aware, and notify the applicable regulatory authority (Data Protection Board of India / relevant EU supervisory authority) as required by law.

12. Children's Privacy

XtraSecurity is intended for users who are 18 years of age or older. We do not knowingly collect personal data from persons under the age of 18. If you believe we have inadvertently collected data from a minor, please contact [email protected] and we will promptly delete it.

13. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

14. Contact Us