Privacy policy

Mitivanta assesses the security of small businesses and gives each one a portal to see what was found and track what they fix. This policy explains what is held, why, and what happens to it. It is written to be read rather than to be defensible.

Who this is about

A client is a business that has engaged Mitivanta for an assessment. A user is a person that business has chosen to give a login to. Mitivanta holds information about the client’s computers and network at the client’s request, and holds an account for each user so they can see it.

What is held about users

• Name and email address, which are how somebody signs in and is addressed.
• A scrambled form of the password that cannot be turned back into it. The password itself is never stored and cannot be recovered from what is, which is why a forgotten one is reset rather than looked up.
• Their role, and which parts of the portal their business has given them.
• What they did in the portal: which remediation steps they ticked off and when, and any notes they added. This is the record the business itself relies on.

What is held about the client business

What an assessment produces: a list of the business’s devices with the names the business uses for them, their operating systems and, where recorded, hostnames and network addresses; the findings from each assessment, including the scanner output they were drawn from; the steps recommended to fix each one; and the business’s own progress against them over time.

This is, by its nature, a record of where a business is vulnerable. It is held for the business, at the business’s request, and is the most sensitive thing this service holds. Everything in the rest of this policy is shaped by that.

What is not done with any of it

• It is not sold, rented or shared with anybody outside the client and Mitivanta.
• It is not used to advertise to anybody, here or anywhere else.
• There is no advertising SDK, no analytics SDK and no tracking across other apps or websites.
• One client’s records are never visible to another. Every request is scoped to the business the person signing in belongs to, and enforced on the server rather than in the interface. Only Mitivanta’s own assessment staff can see more than one client.
• Findings are never made public, aggregated into benchmarks, or used as examples, anonymised or otherwise, without the client asking for that in writing.

The phone app

The app asks for Face ID or Touch ID if that is switched on, and for nothing else. It does not use the camera, location, contacts, the microphone, or the advertising identifier.

Face ID does not send a face anywhere. No image or measurement of a face reaches the app, this company, or any server, and none could: the phone answers yes or no and nothing else crosses that line. What it opens is the login already stored on that handset, held in the device’s secure hardware. Switching it off, or signing out, deletes what it was protecting, and a password always works instead.

Steps ticked off with no signal are stored on the phone and sent when there is one. Until they send, they are only on that device.

Where it is kept, and who else can see it

Data is stored in the United States with three suppliers, each handling one part and each bound by their own agreements: Neon for the database, Render for the application servers, and Cloudflare for any files attached to findings. Nobody else receives it. Access by Mitivanta staff is limited to conducting assessments, keeping the service running, and answering a support request.

Data is transmitted over HTTPS. Attempts to sign in are rate limited against guessing.

How long it is kept

For as long as the client keeps its account, because the value of the history is the trend, and a business that returns after a gap should find its record intact. When an account is closed, its data is deleted within 30 days. Ask sooner and it will be done sooner; ask for a copy first and one will be provided.

What a person can ask for

Anybody may ask what is held about them, ask for it to be corrected, or ask for it to be deleted. Requests are answered within 30 days. Accounts are created by the client business or by Mitivanta, not by the person using them, so an individual account is removed by whoever administers it; if that is not possible, write to the address below and it will be removed directly.

Children

Mitivanta is a tool for businesses. It is not directed at children and no account is knowingly created for one.

Changes

If this policy changes in a way that matters, account holders will be emailed before it takes effect rather than being left to notice the date at the top.

Contact

support@mitivanta.com