Security

An RVTools export describes your infrastructure — hostnames, VM names, IP-adjacent network names, storage layout, operating systems. We treat it accordingly. This page states only controls that actually exist today.

How uploads are processed

• Free instant analysis: your file is parsed entirely in memory on the server, analyzed, and discarded. It is not written to disk, not stored, and not shared.
• Full engagement assessments: when you engage us, the export is archived to a private storage bucket as the working copy for your project, and the parsed inventory (hosts, VMs, findings) is stored in our database so your report is reproducible.

Access control

• The assessment tool and stored assessments sit behind a shared-secret access gate.
• The gate fails closed: if its secret is ever missing in production, access is denied, not opened.
• All database access is server-side only; there is no browser-side database client.

Third-party processors

• Vercel (application hosting), Supabase (database and file storage), Resend (email for lead notifications).
• No AI or machine-learning service receives your infrastructure data. No analytics service receives it either — we do not put inventory contents into logs or analytics events.

Retention and deletion

• Free-analysis files: never retained (in-memory only).
• Raw engagement exports: automatically deleted 180 days after upload by a scheduled daily job. The parsed inventory (the assessment itself) is kept as the engagement record.
• On written request we delete the raw export and the parsed inventory earlier, at any time.

Questions, or a deletion request: see the contact details on the homepage.