Privacy policy

What we hold, and what we refuse to do with it

Effective 20 September 2026.

Polksec is a trust portal. Companies use it to publish their security posture to their own customers. That means we hold two kinds of information — the account and content of the company using the product, and the small amount of data created when somebody visits a portal — and this page says what happens to both.

The short version: we hold what the product needs in order to work, we do not sell it, we do not advertise with it, we do not train anything on it, our staff cannot read your documents, and you can export it or have it erased.

Who is responsible

Two roles, and they are not the same

For your content, you are the controller and we are the processor

The documents, control answers, attestations and visitor records inside your portal are yours. We hold them on your instructions and for your purposes. If somebody asks us to delete or disclose something belonging to your organisation, we tell you rather than acting on it ourselves, unless the law requires otherwise.

For your account, we are the controller

Your name, your work email address and the credentials you register are held by us to run your account and to keep the service secure. That part is our responsibility, and this page describes it.

What we hold

Everything, in four categories

# Category Kept for

Your account Your name, your work email address, and the credentials your organisation has enabled — the public half of each passkey you register, or a password, which is stored only as a PBKDF2 hash and never in a form we can read back. While your account exists

Your content Documents you upload, the answers you write for your controls, your attestations, your branding and your portal settings. Held in a database of your own, with documents encrypted under a key unique to your organisation. Until you delete it

The people who ask for access When somebody requests access to your portal we record the email address they give, the decision you make, and their visits in the security log. That record belongs to you and is kept for you; we do not use it for purposes of our own. Until you delete it

Visitors who ask a question The question form asks for your email address, your name and your organisation. We record all three, because the organisation running the portal needs to know who is asking and how to reply to them — and because "we only kept the message" would not be true of what we actually store. These are deleted on a schedule, not kept indefinitely. Each organisation sets its own window — a year by default, and it cannot be set below thirty days. The deletion is automatic and runs daily. If the organisation publishes an answer to your question, that answer is kept as its own content and is no longer linked to you; what is deleted is your message and the record that you were the person who asked. Each organisation sets its own — a year by default

Operational records Request identifiers, error reports and security events, so a failure can be traced and an access decision can be proved. We do not log document content, and we do not log session tokens or access codes. Short-lived, except the security log

What we do not do

The list that matters more

We do not sell it, share it, or advertise with it

There is no advertising or analytics product anywhere in this service, and no third-party tracker on any page we serve. The public portal carries no JavaScript at all, so there is nothing for a tracker to run inside.

Our staff cannot read your documents

There is deliberately no super-user and no impersonation. Support can see that an account exists, its status and when it was created. There is no view of your documents, your control answers or your visitor records, and reading the customer list is itself written to an audit log.

Nothing is trained on your content

There is no model in this product. It does not generate answers, summarise documents or score your posture, so your content is never used to train anything — ours or anybody else's.

We do not profile the people who visit a portal

We record which account's portal was opened as part of the security log, because the tenant needs to know who read their evidence. We do not build a profile of a visitor, and there is no cross-site identifier to build one from.

Cookies

Two, and neither is for tracking

# Cookie Set when

__Host-psx_session Keeps an operator signed in to the application. It is Secure, HttpOnly, SameSite=Lax, and carries no Domain attribute — which is why a browser will never send it to a customer's portal hostname. On sign-in

__Host-psx_visitor Remembers that a visitor has already redeemed an access code, so they are not asked for it again on every page. It is scoped to the single portal hostname that issued it and expires on its own. On redeeming a code

Somebody who is simply reading a public portal is set no cookie at all. There is no consent banner because there is nothing to consent to.

Where it lives

One infrastructure provider, named

Polksec runs on Cloudflare — Workers, D1, R2 and Queues — and Cloudflare is our only infrastructure subprocessor. Data is stored in the regions Cloudflare provisions for our account, and documents are encrypted at rest under a key unique to each customer.

Payments are not switched on. If we enable them, our payment provider will be named on this page before any card is taken, and card details will be held by that provider rather than by us. Today nothing on this site accepts a card.

How long we keep it

And the part most policies leave out

Deleting a document inside a live account hides it immediately and marks it deleted. The row stays in your database rather than being erased on the spot, because your security log is append-only by design and a record of what happened to your evidence is part of what you are buying. We are telling you that plainly instead of describing it as a shred.

Deleting your organisation is different: it starts a full erasure that runs after a grace period, so that a mistake is reversible for a short while and final afterwards. Your security log goes with the database it lives in. Before you go, you can export your register and your records.

Your rights

Ask, and we will do it

You can ask to see what we hold about you, have it corrected, receive a copy, or have it erased. Write to security@polksec.com. We do not require a form, a specific wording, or a reason, and we answer as a person rather than an autoresponder.

We publish one contact address for both privacy and security matters, because an address that exists and is read beats two where one might not be. If your request belongs to a customer's portal content rather than your own account, we will point you at that customer, who controls it.

Changes

Dated, and not quietly

If this policy changes we will change the date at the top of the page. If a change affects what we hold or who we share it with, we will tell account holders rather than updating the page and hoping nobody reads it again.

This policy describes our own service. It is not a substitute for the privacy notice of a company whose portal you are reading — that company is the controller of what you see there.