Privacy Policy

1. Who we are

Xseth is operated by the Xseth team. You can reach us at benkriefsyef@xseth.com. The marketing site lives at xseth.com; the operator console at app.xseth.com.

2. What we collect

• •Account & intake — name, work email, company, role, and the details you submit on the access form.
• •Targets & scan data — the targets you submit and the recon output produced (subdomains, ports, banners, HTTP and Nmap evidence) plus the generated assessment.
• •Operational data — authentication tokens and basic usage/diagnostic logs needed to run and secure the service.

3. How scan data is processed

Xseth currently runs as a hosted service. To generate your assessment, recon metadata — not your source code or secrets — is sent to our third-party LLM provider (Groq) for analysis. We use it solely to produce your results; we do not sell your data, and we only process targets you've confirmed you're authorized to scan. Self-hosting, which keeps this data inside your own environment, is on our roadmap.

4. Subprocessors

We rely on a small set of providers to run the service:

• •Groq — LLM inference for triage and analysis.
• •Google Cloud — application hosting and infrastructure.
• •Firebase Authentication — sign-in and identity.
• •Web3Forms — delivery of the early-access intake form.

5. Your rights

You can ask us to access, correct, export, or delete your personal data — email benkriefsyef@xseth.com and we'll act on it. Where EU data protection law applies, we use appropriate transfer safeguards (such as Standard Contractual Clauses) for any processing outside the EU.

6. Retention

We keep scan results and account data for as long as your account is active or as needed to provide the service, then delete or anonymize it. You can request earlier deletion at any time.

7. Changes & contact

We'll update this policy as the product and our infrastructure change, and revise the date above. Reach us at benkriefsyef@xseth.com. See also our Terms of Use.