secaudit.eu

Privacy policy

Last updated: 2026-11-03

This page explains what personal data secaudit.eu processes, why, and what you can do about it. It covers the website secaudit.eu, the public verification pages, the panel, the paid plans, and the services the Security Audit & Compliance plugin for WordPress uses.

Who is responsible

  • AngelForce OÜ, Narva mnt 5, 10117 Tallinn, Estonia
  • Registry code: 16520440
  • Email: info@secaudit.eu

We have not appointed a data protection officer. Write to the address above for anything about your data.

Visiting the website

We do not use analytics, advertising or tracking of any kind. Fonts and images come from our own server, and our pages load nothing from other companies. A Buy button on the pricing page takes you to our payment partner's checkout page (see "Paid plans").

We use cookies only in two cases:

  • if you sign in to the panel (see below), a sign-in cookie keeps you signed in;
  • if you arrive through a link of one of our affiliates (secaudit.eu/r/…), the pricing page asks whether it may remember that affiliate's code. Only if you agree does it keep the code in a cookie named sa_ref for 60 days, so the affiliate is paid if you buy a plan later. The cookie holds nothing but the code. If you do not agree, nothing is stored on your device; the code is passed to the checkout only if you buy from that same page. You can withdraw your consent at any time with the "Forget the partner link" link on the pricing page, which deletes the cookie. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies).

Our cookie policy lists every cookie and everything else we may store in your browser.

For each affiliate code we count only how many visits it brought per day, as a number; we record nothing about you for it.

To send you a page, our server has to receive your IP address and the usual technical details of the request (browser type, requested address, time). We do not keep access logs, so this information is not stored after the page is delivered. If something breaks, the server may log the error, without your IP address.

Our website is delivered through Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which protects it against attacks and overload. Cloudflare processes your IP address and request details for us as a processor under a data processing agreement. Transfers to the USA are based on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Our server is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, as our processor under a data processing agreement (Art. 28 GDPR). The server is in Hetzner's data centre in Nuremberg, Germany, so this data stays in the EU.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is delivering the website securely.

The verification service (only if a site operator turns it on)

In the WordPress plugin, a site operator can choose to publish a public verification page on secaudit.eu. This is off by default. When it is on, the plugin sends us:

  • the site's domain name and WordPress path
  • its security score, the date of the last audit, and whether the malware, core-file and spam-link checks passed
  • the plugin version
  • optional business details the operator enters: company name, a short description, country and field of business

Detailed findings, file names, user names and the content of the site are never sent.

To make sure the request really comes from the site, our server connects back to that site once to check a one-time token. Each time, our server also downloads the site's public home page to apply our listing policy (we do not list adult, gambling, piracy or other illegal content) and to look for spam links hidden from visitors. The home page is checked and then discarded. If a site is refused, or hidden spam links are found, we keep the domain, the reason and the matching keywords for 180 days, so we can handle complaints and correct mistakes.

To stop the service being flooded, we count requests per IP address. We store only a one-way hash of the address and delete it after 48 hours.

All of this is about websites, not people. It becomes personal data only where the business details identify a person, for example a sole trader who enters their own name. Please enter business information only.

Legal basis: Art. 6(1)(b) GDPR, because the site operator asks us to provide the page, and Art. 6(1)(f) GDPR for the abuse protection and the listing check.

How long we keep it: the page and its data stay while the option is on. When the operator turns the option off, the plugin asks us to delete the page and we delete it immediately. Without a new audit for 30 days, the page says the verification has expired. You can also ask us at any time to delete a page for a site you run. Deleted data also disappears from our backups, as described under "Backups".

The verification page is public by design: anyone can see the domain, score, audit date and the business details the operator entered.

The malware-signature feed

If a site operator turns on automatic signature updates in the plugin, the site downloads a signed list of malware signatures from secaudit.eu once a day. This download sends no information about the site. Our server sees the IP address of the web server making the request, as with any website visit, and does not store it.

Sites with a paid plan download the newest list from an address that needs their license key; that request sends the key and the site's address, which we use only to check the plan and do not store beyond the usual request counter (deleted after 48 hours).

Legal basis: Art. 6(1)(f) GDPR (delivering the requested file).

Report documents (only if a site operator asks for one)

When an administrator presses "Download signed report" in the plugin, the site sends us the report's content so our server can lay it out and sign it: the site's address, WordPress, PHP and plugin versions, the score, and for each finding its title, severity, the affected plugin, theme or file path, and the status of each GDPR/NIS2/CRA measure. Not sent: user names, passwords, file contents, visitor data. To make sure the request comes from that site, our server calls the site back once. We keep the content only while making the file (seconds) and then delete it. We store a record of the document: its report code, site address, report type and format, the date, the plan, and a fingerprint (SHA-256) of the file, so the code can be checked later. We keep this record for 3 years and then delete it.

Legal basis: Art. 6(1)(b) GDPR (providing the service you asked for).

Checking that the plugin is an original copy

Once a day the plugin downloads from secaudit.eu the signed list of files of its own version and compares them on the site. This download sends no information about the site; our server sees the IP address of the web server, as with any website visit, and does not store it. The result (original, changed or unknown) is part of the verification report only if the site operator turned the verification service on.

The vulnerability database

If a site operator turns on our vulnerability database in the plugin, the site downloads a signed index from secaudit.eu once a day and, using it, the parts of the database that cover its own plugins and themes. The database is split into 256 parts by the first characters of a fingerprint (hash) of each plugin's or theme's name. The site works out which parts it needs, downloads them, and compares versions on the site itself. The list of installed plugins and themes and their versions is never sent to us, and each part covers hundreds of plugins, so the parts a site downloads do not reveal which plugins it uses. Our server sees the IP address of the web server making the request, as with any website visit, and does not store it.

The database itself contains no personal data: it is built from the public CVE List of the CVE Program (© The MITRE Corporation, used under the CVE Program Terms of Use).

Legal basis: Art. 6(1)(f) GDPR (delivering the requested files).

Shared list of attacking IP addresses (only if a site operator turns it on)

In the WordPress plugin, a site operator can choose to take part in a shared list of IP addresses that attack WordPress sites. This is off by default. A site can take part only after it has proved to us that it controls its domain, in the same way as for the verification service.

When the plugin on a participating site blocks an attack, it sends us:

  • the IP address the attack came from
  • the kind of attack (for example password guessing, SQL injection, or a request for a secret file)
  • the time

It does not send the address of the page, the content of the request, user names, or anything about the site's other visitors. We store each report with a pseudonym of the reporting site (a keyed hash of its domain), not the domain itself.

An IP address goes on the shared list only when at least five different sites report it within seven days. We never list private network addresses or the published addresses of the major search engines. Participating sites download the list and treat those addresses more strictly, for example by blocking them or by asking them to pass the robot check. Only participating sites can download the list; we do not publish it.

How long we keep it: reports are deleted after seven days. An address leaves the shared list at the latest seven days after the last report about it.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, shared with the participating sites, is protecting websites against attacks; recital 49 GDPR names processing for network and information security as such an interest. Because an IP address can identify a person, we keep as little as possible and only for a short time.

If you believe your IP address is on the list by mistake, write to info@secaudit.eu with the address. We remove it within 72 hours unless new attacks are reported from it. You can also object to this processing under Art. 21 GDPR.

Downtime and certificate alerts (only if a site operator turns them on)

In the WordPress plugin, a site operator can ask us to watch the site from outside and to email them when it cannot be reached or when its HTTPS certificate is about to expire. This is off by default. A site can sign up only after it has proved to us that it controls its domain, in the same way as for the verification service. The alerts start only after the person who will receive them confirms the email address with a link we send to it.

What we store:

  • the domain and the address of its home page
  • the email address for the alerts and the language of the mails
  • the result of the latest check: reachable or not, since when, the error, and the expiry date of the certificate
  • the events of the last 30 days: down, back up, certificate warnings

What we do: every five minutes we request the site's home page and read only the first part of the answer; once a day we read its certificate. We do not open other pages, do not log in and do not keep any page content.

How long we keep it: events are deleted after 30 days. A sign-up, or a new alert address, that is not confirmed is deleted after 7 days; until a new address is confirmed, the alerts keep going to the previous one. When the site operator turns the alerts off in the plugin, or when anyone uses the "Stop these alerts" link in an alert mail, we delete the site, its email address and its events at once.

The mails are sent through Google Workspace (Google Ireland Limited), which processes the email address and the message for us as our processor. Google may process data outside the EU; such transfers are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Legal basis: Art. 6(1)(b) GDPR. The person who receives the alerts asked for this service and confirmed it.

Off-site scanning (only if a site operator turns it on)

In the WordPress plugin, a site operator can let secaudit.eu do the heavy part of the malware scan, so that the site's own server is not slowed down. This is off by default and can only be turned on after the site has proved that it controls its domain, as for the verification service.

What the plugin sends: the code files (PHP, JavaScript and similar) of plugins, themes and must-use plugins that it cannot verify itself, WordPress's own add-on files in the wp-content folder, and files in the uploads folder only if they contain PHP code (which does not belong there). Files that match the official WordPress.org plugin checksums are not sent. Never sent: wp-config.php and any other file in the main WordPress folder, database dumps, logs, keys, files in cache, log and backup folders, and images or documents without PHP code; the plugin scans the few code files it does not send itself. The plugin does not send file names or folder paths; it first sends a fingerprint (SHA-256 hash) of each file, and the file itself only if we have not checked a file with the same content before.

What we do with a file: we scan it in our server's memory and answer whether it matches a malware rule. The content is never written to disk and never kept: it is gone when the scan of that batch ends, usually within a second. Code files can contain personal data in rare cases (for example an email address in a comment); we do not look at it or use it for anything else.

What we store: for each joined site, its domain, a hash of its key, when it joined and when it was last seen, and how many bytes it sent today (to keep the service fair); and for each file content we have checked, its fingerprint, the rules that matched (if any) and the day we checked it. The fingerprints are not linked to the site that sent the file. Fingerprints of clean files are deleted after 90 days, of files that matched a rule after 365 days, the byte counters after two days. When the site operator turns the service off in the plugin, we delete the site at once.

Legal basis: Art. 6(1)(b) GDPR — the site operator asked for this service. Where a sent file contains personal data, we process it on the site operator's behalf and only to scan it (Art. 28 GDPR).

AI assistance (only if a site operator turns it on)

In the WordPress plugin, a site operator can ask an AI model for help with the plugin's findings. This is off by default and can only be turned on after the site has proved that it controls its domain, as for the verification service. Nothing is sent until someone presses one of the AI buttons in the plugin; each press sends one request.

What the plugin sends, depending on the button:

  • "Explain": the type and level of one finding, its description and where it was found (for example a file path in the site's folders or a user name the finding is about)
  • "Second opinion": the same, plus an excerpt of the code around the finding (at most 8 KB); passwords, keys and similar secrets are replaced by [REDACTED] in the plugin before sending, and again on our server
  • "Incident draft": the number of open findings by level, the types of findings, the date the problem was first noticed and the names of the clean-up steps already done; neither the site's name nor its domain is passed to the AI model (the plugin fills in the name afterwards)
  • "Server advice": the plugin's measurements of the last 7 days as numbers (how long pages took to build, PHP memory use and limit, pages stopped by the memory or time limit, server load, PHP version, whether OPcache and an object cache are on, free disk space, late scheduled tasks, size of the settings loaded on every page) and the names of the problems the plugin found; nothing from the site's content, and neither its name nor its domain is passed to the AI model

Code excerpts can contain personal data in rare cases (for example an email address in a comment). We do not look at the requests ourselves.

What we do with a request: our server passes it to an AI model, checks the answer and sends it back to the plugin. The answer is advice only: it never changes the site's findings, score, seal or verification page. The model is provided by Anthropic (Claude; Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland); only when Claude is unavailable, by OpenAI (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland). Both act as our processors under their data processing agreements. Anthropic's commercial terms do not allow it to train models on the requests; OpenAI may process them only to provide its service to us. They may process data outside the EU; both data processing agreements cover such transfers with the European Commission's standard contractual clauses.

What we store: for each joined site, its domain, a hash of its key, when it joined and when it was last seen; how many requests of each kind it made per day (to apply the daily limits; kept for 30 days); and the answers, so that the same question from the same site is not asked twice (kept for 30 days, linked to that site only). The requests themselves wait in a queue on our server for at most two minutes and are deleted once answered; an answer that is not collected is deleted after 15 minutes. When the site operator turns the service off in the plugin, we delete the site, its answers and its counters at once.

Hidden links: with AI assistance on our server, the check of a published site's home page for links hidden from visitors (see "The verification service") can also ask the model whether such links are spam in any language. Only the text and the domain of the hidden links are sent. The model can only confirm spam; the result is stored for 30 days for that site.

Legal basis: Art. 6(1)(b) GDPR — the site operator asked for this service. Where a request contains personal data, we process it on the site operator's behalf and only to answer it (Art. 28 GDPR). For the hidden-link check: Art. 6(1)(f) GDPR, our legitimate interest in an honest seal.

The panel (only if you create an account)

At app.secaudit.eu, someone who looks after one or more WordPress sites can see their security summary, history and downtime checks on one page. Nothing is stored unless you ask for a sign-in link there.

Your account:

  • your email address, the language of the mails, when the account was created and when you last signed in
  • you sign in with a link we email to you (valid for 15 minutes, usable once) or with a passkey you added; for a passkey we store only its public key, the name you gave it and when it was added and last used — the private key never leaves your device
  • while you are signed in, a cookie named sa_agency holds a random session value (it is needed for signing in and lasts 30 days); we store only a hash of it and whether the session started with a link or a passkey

Registration. After your first sign-in we ask once for your name, your country and, if you act for a company, its name, and for your acceptance of the terms of use and this policy. We store these with the version you accepted and when. Without a registration the panel shows only the registration form. Legal basis: Art. 6(1)(b) GDPR.

Two-step sign-in. Accounts that link sites or join the affiliate programme turn it on; for everyone else it is optional. Once it is on, signing in with an emailed link also needs a 6-digit code from an authenticator app on your device. We store the app's secret key (needed to check the codes), the time step of the last code used (so a code works only once), when it was turned on, and fingerprints (hashes) of your ten recovery codes, never the codes themselves. Between the link and the code, a sign-in ticket exists for at most 10 minutes; we store only its hash and the number of wrong tries. Turning it on or off and using a recovery code are recorded in the audit log and announced to you by email. When you turn it off, all of this is deleted at once. Legal basis: Art. 6(1)(b) GDPR.

Linked sites: to link a site you create a one-time code in the panel (valid for one hour) and enter it in the plugin on that site; the site must also prove that it controls its domain, as for the verification service. For each linked site we store:

  • the domain and path, and a hash of the key the site uses to send its summary
  • the summaries the plugin sends after each scan and once a day: the score, the number of open findings by level, the time of the last scan, the number of pending updates (WordPress, plugins, themes), the WordPress, PHP and plugin versions, whether the site uses HTTPS, and the share of administrators with two-factor authentication as a percentage
  • a history of these numbers (at most one entry per hour), so the panel can show how the site changed, and a list of what happened to the site (a new summary with a changed score, the site went down or came back, a certificate warning, the site was linked or removed, its public page changed)
  • the findings of the latest scan, so the panel can list them: for each finding its level, its kind (for example malware, known vulnerability, configuration, code or content), a short title and the plugin, theme or component it concerns (for example "WPCode Lite 2.2.5: CVE-2026-8832, update to 2.4.0"); each scan's list replaces the previous one

The plugin does not send file paths, the names of users, the content of pages, posts or comments, passwords or keys, or anything about the site's visitors.

How long we keep it: unused sign-in links and codes are deleted after one day, sessions after 30 days. The history is kept for 400 days and the list of events for 30 days. A site that has not sent a summary for 90 days is removed. An account that nobody has signed in to for two years is deleted with its sites. When you remove a site in the panel or unlink it in the plugin, we delete it at once (its history within the periods above); when you delete your account in the panel, we delete the account, its registration, two-step sign-in settings, sites, passkeys and sessions at once.

Changes our staff make in the panel (for example revoking a listing) are recorded in an audit log with the staff member's account, the time and the IP address they used, and kept for two years.

The sign-in emails are sent through Google Workspace, as described under "Downtime and certificate alerts".

Legal basis: Art. 6(1)(b) GDPR. You asked for this service by creating the account and linking the sites.

API keys (only if you make one). In the panel you can make keys for your own tools to read your sites' data through our API. We store each key's name, its first characters, a keyed fingerprint of the key (never the key itself), when it was made and when it was last used. Making and revoking keys is recorded in the audit log. A revoked key is deleted at once.

Our payment partner. Plans are sold through our payment partner, which acts as the merchant of record for the purchase. Its name is shown at checkout and on your receipt. It is an independent controller for the purchase: your name, payment details, billing address and tax details go to our payment partner, not to us, and its own privacy notice applies (it is linked on the checkout page).

When you click a Buy button on the pricing page, your browser goes to our payment partner's checkout page, so the partner receives your IP address and browser details from that moment on. The pricing page itself loads nothing from the payment partner.

What our payment partner tells us. It sends us, in signed notifications, a customer number, the email address used at checkout, and for each subscription its number, plan, status, price, currency and the end of the paid period; the language comes from our own pricing page. We use this to issue and check license keys, to show your plan in the panel, to send you the mails that belong to the plan (the license key, a reminder before each yearly renewal, a locked key, urgent vulnerability alerts if you turn them on) and to answer your questions. We do not send advertising. Legal basis: Art. 6(1)(b) GDPR. These mails go through Google Workspace (see "Email"). Where our payment partner makes them available to us, you can also see and download the invoices of your plans in the panel; we read them when you open the page and do not store them.

Payments and refunds. For each payment our payment partner reports, we also note its payment number, date, plan, whether it was a first payment or a renewal, the amount with the VAT in it, and what the partner pays out to us after its fee; for each refund or chargeback, its number, state and amount. Only our own staff see this list, in the panel, to keep track of sales and refunds. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in keeping our books) and Art. 6(1)(c) GDPR (accounting duties). We keep it for 7 years, as the Estonian Accounting Act requires for accounting records.

License keys. We mail the key once and keep only a keyed fingerprint (HMAC) of it, never the key itself. For each site that uses a plan we store its address and when it joined; a site joins only after our server has checked that it controls its domain, as for the verification service. To stop shared keys, we keep a counter of how many new sites tried to use each key in the last day; the counter is deleted after 48 hours. A key over the limit is locked and its buyer gets an email. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for the misuse protection (our legitimate interest in fair use of the plans).

Urgent vulnerability alerts (optional). If you turn this on in the plugin, the daily check-in also sends the list of installed plugins and themes with their versions, the WordPress and PHP versions, and the version of the server's PHP package. When a newly published serious vulnerability enters our database, or we publish an urgent advisory ourselves, we compare it with these lists at once and email the license owner's address if the site is affected; each vulnerability is mailed once per site. We keep only the latest list per site and delete it when you turn the option off, when the plugin stops using the plan, or at the latest 8 days after the plan has ended. Not sent: user data, content, file contents or anything about visitors. Legal basis: Art. 6(1)(b) GDPR.

How long we keep it. While the plan exists, and the plan, its sites and alerts for 12 months after its paid period ended (to answer questions and claims, for example about a refund); the customer record 12 months after its last plan is gone. Then it is deleted automatically. Invoices are issued and kept by our payment partner.

Affiliate programme (only if you join)

If you join our affiliate programme in the panel (a registration and two-step sign-in are needed first), we store, in addition to your panel account: whether you join as a private person or a business; your legal name; for a business, the company name and its registration number; your address (street, postcode, city, country); your VAT or tax number if you give one; where you plan to promote us (a website or channel); your affiliate code, when you joined and which version of the affiliate terms you accepted; how many visits your link brought per day (only a number); for each sale through your link the payment and subscription numbers of our payment partner, the net amount, the commission and its state (we do not show you who bought); for later payments of those subscriptions, their net amount, to work out the yearly renewal bonus; the payout details you enter (account holder, IBAN or PayPal address, and for accounts outside the SEPA area the BIC and bank name); and each payout with its amount, dates and bank reference.

The account holder must be you or your company. Changing the payout details needs a recent sign-in, is recorded in the audit log and is announced to you by email; new details take effect after 7 days, and until then we keep the previous ones and pay to them.

How long we keep it: payout records and the commissions they cover for 7 years, as the Estonian Accounting Act requires; everything else until you leave the programme, then 12 months for open claims. Legal basis: Art. 6(1)(b) GDPR (the affiliate agreement) and Art. 6(1)(c) GDPR (accounting duties).

Email

If you email us, we use your address and message to answer you and keep the conversation as long as needed for that purpose, or as long as the law requires.

Our mailbox is hosted by Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which processes emails for us as our processor. Google may process data outside the EU; such transfers are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.

Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where your message is about using our services.

Backups

We keep seven daily copies of the data on our server, readable only by our administrator. Once a week, an encrypted copy is also sent to our own Google Workspace mailbox (see "Email"); we keep these copies for up to three months and delete older ones once a month. Data that you or a plugin asked us to delete is therefore gone from the daily copies within 7 days and from the weekly copies within about four months. We use the copies only to recover from a failure; if we ever have to restore one, we delete again what had been deleted.

Who else receives data

Only the service providers named above (our hosting provider, Cloudflare, Google Workspace for email, the weekly encrypted backup, the downtime alerts and the panel's sign-in links, and Anthropic and OpenAI for AI assistance), and only to run secaudit.eu for us. Our payment partner receives the data of a purchase as the seller (merchant of record) and an independent controller (see "Paid plans"). Participating sites receive the shared list of attacking IP addresses, which contains IP addresses only. We do not sell or rent data and do not use it for advertising.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to info@secaudit.eu; we answer within one month.

You can also complain to a data protection authority. In Estonia that is the Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee. You may also contact the authority in the EU country where you live or work.

Changes

If we change how we process data, we update this page and the date at the top.