Privacy, clearly explained.
Privacy and practical expectations
We do not store raw source code, database credentials, customer records, or proprietary business logic. Sensitive business data does not belong in an assessment upload.
There are no automatic uploads or application changes. Review sanitized metadata and questionnaire answers before sharing: project paths and database object names can still be sensitive. Never upload source archives, database backups, credentials, or customer records.
If database checks are skipped, SQL Server is marked Not assessed. Schema findings suggest potential improvements; confirming slow queries requires separately authorized performance evidence. Modernization preserves compatible code and proven behavior wherever practical.
Read the assessment privacy policy
The scanner runs locally and makes no automatic uploads. Optional SQL Server checks inspect schema metadata through authorized read-only access. SQL credentials are held in memory, cleared after the scan, and excluded from the assessment output.
When you choose to import an assessment, the portal stores sanitized findings, project and package metadata, database object metadata if assessed, your selected objective, optional business answers, and generated documents. Account information is used for portal access. Technical paths, object names, and free-text answers can still reveal business details; inspect and remove sensitive information before import.
Do not include secrets, database backups, row data, personal or financial customer records, confidential business documents, or proprietary algorithms. Use high-level business descriptions rather than sensitive operational details. Reports may reproduce the assessment information you submit.
Core assessment and reporting work without AI. This walkthrough is served directly from this website. It uses no external video-hosting player. Any optional AI assistance must use sanitized assessment information only.
When enabled, Plausible measures public page visits and scanner-download clicks, including referral sources and campaign tags. Account pages, verification tokens, email addresses and assessment data are excluded. A download click is an indication of interest, not proof that installation or scanning completed. Do not put personal information or secrets in campaign tags.
When enabled, Cloudflare Turnstile checks public account forms to reduce automated abuse. Cloudflare processes the browser signals needed for verification. Authenticator secrets are encrypted, recovery codes are stored as hashes, and neither is sent to analytics or included in account emails.
Each signed-in user can access only their own uploads and generated reports. Authorized administrators can review all assessments to operate and support the service. Consultant accounts do not receive access to other users’ data.
No marketing spam or unsolicited sales contact. We discuss consulting only at your request or for a meeting agreed with you. Account signup does not subscribe you to promotional communications. Verification, password-reset links, and necessary security notices are sent through SendGrid, which processes the recipient address and message for delivery. Assessment findings and reports are not attached to these emails. Queued emails are encrypted and retried; the envelope is cleared after successful delivery.
You can delete an assessment and its imports, questionnaire answers and generated documents from your dashboard. Previously downloaded copies cannot be recalled. Deletion audit records retain ids, actions, actors and dates without assessment contents. Automated retention is operator-controlled and disabled until activated; its default interval is 180 days since the last import. Confirm the active interval and hosting backup expiry before sharing confidential metadata. For account deletion or data questions, connect through atribanerjee.com.