Skip to main content
EVULNABLE

Privacy

Privacy

Three kinds of data reach EVULNABLE and they are not alike. This page keeps them apart, because a single sentence about all three has been wrong about one of them every time anybody has checked.

EVULNABLE runs a public vulnerability-management site and a commercial due-diligence service. They are separate applications, and the data each one handles is different enough that one description would be wrong about at least one of them.

Category one — reading this website

Everyone who loads a page. No account is involved, because there is no account.

What arrives without you typing anything

  • Request logs. Time, path and client IP address, as any web server records. Operational logs, not a profile, and not joined to anything you enter.
  • Browser error reports. If your browser blocks something on a page, it may report what was blocked, on which page, and your user-agent string. These are read to find bugs.
  • Aggregate analytics. A privacy-focused analytics provider records page views and loading performance. It sets no cookies and does not fingerprint or follow visitors between sites. It is the only third-party script on the site.

What is stored in your own browser

  • A theme cookie, only if you click. Choosing light or dark stores the choice for a year. It holds a color name and no identifier.
  • Your watchlist, in local storage, on your device. It is never sent to us, and clearing your browser data clears it.
  • Nothing else. No advertising, no advertising network, no cross-site identifier, and nothing sold or shared with data brokers.

The full detail, including what a search sends VM site

Category two — searches and domain checks

What you type into the vulnerability tools.

What leaves, and what is kept

  • A search term goes to the source that answers it. A CVE or product search is sent to public vulnerability databases; a domain you check is looked up through public DNS and fetched from that domain's own host. Nothing about you is attached to it.
  • Request logs (IP address and page requested) are kept for a limited time and then overwritten. Scan results are deleted after 30 minutes.
  • No upload is accepted. The site does not accept scan files.

What not to type

Do not type regulated or contractually restricted information into a search box or the domain checker.

Category three — a due-diligence subject

The materially different one. This data is about somebody who did not upload it, is not our customer, and in most cases does not know a report was ordered.

What the service receives and sends

  • Subject information is processed with AI. The research and analysis passes send it to AI processing. If a customer names a person — their role, stated concerns, free-text notes — that text is part of what is transmitted.
  • Registry and sanctions lookups reach the registries. Company registers, sanctions lists and filings are queried directly, as any researcher would.
  • No human reviews a report before delivery. Every report says so on its face.

Contacting us

There is no contact form on this site, and no mailing list. Everything goes to [email protected]: questions about this page, requests to correct data in a report, and security reports.

Service providers

We use service providers that help us run the site and the due-diligence service, including analytics, payment and AI processing. The vulnerability tools query public sources to answer your lookups.

Security

If you believe the site is doing something other than what this page says, that is a security report and will be treated as one.

Changes

This page changes when the software does.