DefenceLevel
How we protect My Defence data
My Defence describes your infrastructure: vendors, products and, if you wish, notes with models and versions. This is sensitive information for anyone working in security, and we treat it accordingly. Here is what we store, where, who can see it and what we do not do.
What we store
- the vendors and products you choose, zone by zone;
- the diagram: the zones, their connections, the names and descriptions you write, and the notes you add to the zones;
- your email choices: the briefing every day or only about your products, alerts for everything or only about your products.
My Defence is optional: without it you still receive the full briefing and the alerts.
Encrypted, with the key outside the database
In the database, vendors, products, diagram and notes are encrypted with AES-256-GCM. The key is not in the database: it is kept separately, in the service's protected settings. Anyone accessing only the database, one of its backups or an export of it would see nothing but encrypted text.
- The service decrypts the data only in memory, when it is needed: to show it to you in the dashboard and to choose which briefing items and which alerts concern you.
- Each encrypted text is bound to your account: copied to another account, it cannot be decrypted.
- To recognise a choice already made we use a fingerprint that does not reveal the name and differs from one account to another: two companies with the same product do not have the same fingerprint.
Where the data is
- The database is in the European Union, in Ireland; the service's functions also run in Ireland, in Dublin.
- Every connection is encrypted. The providers also encrypt disks and backups.
- The list of providers, with their role and location, is in the privacy policy.
Who can see it
- No other subscriber. Names our catalogue does not know are looked up in NIST's National Vulnerability Database without any data about you: if they exist, they enter the catalogue under their official name, the same for everyone; if not, other subscribers do not see them.
- No one outside the service. Public access to the database is closed: without the service's credentials, no table can be reached from outside.
- Not the administration area. It shows only how many products and zones an account has, never which ones.
- Not artificial intelligence. The AI checks that write and verify the texts of the briefing and alerts read only public vulnerability data, through a database user that cannot open subscribers' data.
- Emails. If you choose «Only my products», the emails you receive are about the vulnerabilities that concern you and, like any email, they pass through the provider that sends them.
We do not use this data for any other purpose, we do not share it with anyone and we do not sell it.
How long
Until you remove it from the My Defence page. If you delete your account it is deleted immediately; in the database backups it remains, encrypted, until they expire, at most 7 days.
Checks and reports
We are arranging an independent security test by a specialised company: once it is complete, we will publish the result here. If you find a security problem in our systems, write to us as explained on the Security reports page.
For companies
If your company needs a data processing agreement (DPA), for example for NIS2 obligations towards suppliers, it is ready: download the PDF, fill in your company's details, sign it and send it to privacy@defencelevel.com. We send it back signed by us too.