Privacy notice

Last updated 5 September 2026

Who we are

The controller is Ecavist Technologies, a business registered in Türkiye at Dörtyol Küme Evleri No: 369, İç Kapı No: 3, Işıklar, Merkez, Çanakkale, Türkiye, trading as Attestkeep. Registration details are on the company page.

Anything about this notice — a question, a request, a complaint — goes to legal@attestkeep.com. There is no separate data protection officer; the business is small enough that the person named above answers.

What we hold, and why

The whole of it, in one table. Everything below the table is these same rows explained.

What	Why	Legal basis	Kept for
Account: e-mail, password hash, name, individual or company, company name, tax number, country	To run the account, issue licences and put the right name on an invoice	Performance of the contract	While the account exists, then 30 days
Your acceptance of the agreements: the date and which version	To show what you agreed to, if it is ever disputed	Legal obligation and our legitimate interest in holding evidence	10 years from the end of the relationship
Sign-in sessions and the six-digit codes	To sign you in and to let you end a session you do not recognise	Performance of the contract	Until expiry or sign-out; codes, minutes
Licences, cluster fingerprints, activation and release dates, last check-in, operator version	To decide whether a cluster may run a licence and to count clusters against what was bought	Performance of the contract	Life of the licence, then the statutory period
Subscriptions and order references from Polar	To know what was bought and what renews	Legal obligation (tax and commercial records)	10 years
Server logs: IP address, timestamp, path, user agent	To keep the service running, rate-limit abuse and investigate an incident	Our legitimate interest in operating and protecting the service	No more than 30 days
Administrative audit trail: which admin did what, to which account	So that an action taken on your account can be accounted for	Our legitimate interest in an auditable back office	3 years
E-mail you send us	To answer it, and to have context if you write again	Our legitimate interest in answering correspondence	24 months, or with the advisory for a security report

There is no other category. We hold no address (Polar collects it at checkout, we do not copy it), no card details at any point, no marketing profile, no analytics identifier, and nothing about what you scan or run.

This website

There is no analytics script, no tag manager, no advertising pixel and no third-party embed on these pages. Fonts, images and stylesheets are served from this domain, so loading a page tells no one but us that you were here.

The web server keeps the access logs described in the table above. They are used to run the site and to spot abuse, they are not used to build a profile of you, and they are not combined with anything else.

The site sets no cookies. It stores one thing on your device, and only after you answer the bar that asks: your answer. The cookie notice is the whole of that story.

The product

Attestkeep runs inside your own Kubernetes cluster. Your findings, image names, verdicts, exceptions and evidence packages are written to a PostgreSQL database you control. We have no access to them, no copy of them, and no channel through which they could reach us.

The operator makes exactly one kind of outbound request to us, for licensing, and the next section lists its contents field by field. There is no telemetry alongside it and no usage analytics: nothing reports what you scanned, which frameworks you opened, how many people logged in or what any of them did. Those things are counted inside your cluster where they happen, or not counted at all.

You are the controller for whatever personal data your own cluster processes, and we are not a processor of it — we never receive it. If your procurement needs that in a signed document, the data processing terms say it in the form they expect.

What leaves your cluster

Every installation is licensed, Community Edition included, so this section applies whether or not you pay us anything.

At activation, once per cluster, the installation sends the activation key you were issued and a fingerprint of the cluster. The fingerprint is a hash of your cluster's kube-system namespace identifier; it is an opaque value that identifies the cluster to us without describing it, and it cannot be reversed into a name, an address or anything about what runs there.

Once a day thereafter, the installation checks its licence with us and sends three values: the licence identifier, that same cluster fingerprint, and the operator version. The request reaches us over TLS and its source IP address appears in our server logs, as any request's does.

That is the complete list. Neither request carries:

• image names, digests, registries or any scan finding,
• CVE identifiers or anything about your vulnerabilities,
• workload, namespace, node or cluster names,
• cluster topology, size or configuration,
• user accounts, e-mail addresses or console activity,
• counts of what you scanned or which frameworks you use,
• any row, file or export from your database.

The limits your plan sets on images and frameworks are counted and enforced by the operator inside your own cluster, which is why no count needs to travel. The one limit we hold is the cluster count, because nothing inside a single cluster can see the others.

What we do with it. Decide whether a licence may run on the cluster asking, count clusters against what was bought, and notice a key being spread across more of them than it pays for. Nothing here is used for profiling, advertising or scoring you, and none of it is sold.

Payments

Payments are taken by Polar Software, Inc., the merchant of record that resells the licence to you. Polar collects the billing address and payment details on its checkout, stores the payment method for renewals, issues the invoice, and as the seller of record and for its own legal duties is its own controller of that data under its own privacy policy. We receive the plan, the order reference and the status of the subscription. We never see or store a card number.

When you write to us

If you e-mail support@attestkeep.com, legal@attestkeep.com or security@attestkeep.com, we keep the message and your address for as long as it takes to deal with it and for a reasonable period afterwards, so a follow-up has context. Security reports are kept with the advisory they belong to, because that is the record of when a thing was found and fixed.

We send no marketing e-mail. What arrives from us is transactional: a sign-in code, a licence key, a renewal or failure notice, an answer to something you asked.

Who else touches it

Three companies, each for one job, each named on the sub-processors page with what they handle and where they are. That page is the current list; it is updated before a new one is added, not after.

Nobody else receives your data. We do not sell it, we do not share it for anyone else's marketing, and we hand it to an authority only where a law we are subject to requires it — in which case we tell you, unless telling you is itself prohibited.

Where it is kept

The database, the application and the mail server are on a single server in Türkiye. That is where your account, your licences and our logs live, and they are not copied elsewhere.

Two of the three sub-processors are outside Türkiye and the EEA, both in the United States: Polar, which takes the payment as merchant of record, and Cloudflare, which operates our authoritative DNS and runs the Turnstile bot check on our sign-up, sign-in, password-reset and contact forms; page requests and account traffic do not pass through them while the proxy stays off. Transfers to them rest on the safeguards described on the sub-processors page. If we ever turn the Cloudflare proxy on, that page and this paragraph change first.

How it is protected

Passwords are stored as Argon2id hashes and never in a readable form. Activation keys are encrypted at rest; session and e-mail tokens are stored only as hashes. Everything travels over TLS. The admin surface is a separate hostname that can be restricted at the edge, and every administrative action is written to an audit trail. Passwords, tokens and keys are never written to a log.

If a breach ever puts your data at risk, we notify the competent authority within 72 hours of becoming aware of it and tell you directly where the risk to you is high. We would rather tell you early and be wrong about the severity than tell you late.

Your rights

You can ask us to:

• tell you whether we hold anything about you, and give you a copy;
• correct anything inaccurate or incomplete;
• erase what we hold, where we have no obligation to keep it;
• restrict what we do with it while a dispute about it is open;
• hand you a portable copy in a machine-readable form;
• stop processing that rests on legitimate interest, by objecting to it.

Write to legal@attestkeep.com from the address on the account. We answer within 30 days, free of charge. If a request would leave us unable to keep a record the law requires — an invoice, for instance — we say which part we cannot erase and why, rather than refusing the whole request.

Closing an account. There is a delete button on the account page. Pressing it schedules the deletion for seven days later and e-mails you the date; until that moment the request can be withdrawn from the same page and nothing has happened. On the day, the account is erased — name, address, tax details, password, sessions — and every licence on it is revoked, so installations using them fall back to Community Edition.

What survives is the commercial record tax law obliges us to keep: what was bought and invoiced, for its statutory period, with nothing in it beyond what an invoice needs. The account row itself stays only as an identifier those records hang from, holding a placeholder address that cannot receive mail.

If you would rather we did it by hand, or you cannot reach the page, legal@attestkeep.com does the same thing within the same seven days.

If our answer does not satisfy you, you can complain to a supervisory authority: in Türkiye the Personal Data Protection Authority (KVKK), elsewhere the authority for your country. Complaining to them does not cost you the right to come back to us.

Profiling, children, changes

We make no automated decisions that produce legal effects for you, and we build no profiles. The one automated decision in the system is whether a licence may run on the cluster asking, which is a comparison of counts and dates, not an assessment of a person.

The service is for organisations and the people who run their infrastructure. It is not directed at children and we do not knowingly hold a child's data.

When this notice changes, the date at the top changes with it. A change that affects what we do with data already held is announced by e-mail to the account before it takes effect, not merely posted here.