Privacy

We process account details (name, email, password hash), verified domains, scan results, and optional encrypted session cookies you provide for authenticated Deep scans.

Session cookies are stored encrypted for the lifetime of that scan and used only to request in-scope targets you authorised. Do not paste production admin credentials — use dedicated test accounts.

Scan evidence and findings are retained so you can reopen history, export executive reports, and retest. You can delete investigations from History or clear history in Settings.

Payment processing (when enabled) is handled by Stripe. We do not store full card numbers on MrPenetrator servers.

Contact: use your account email on file for privacy requests related to your organisation workspace.