Privacy

Who is responsible

SOC Monitor is run by me, Md Jewele Islam, House #15, Malotinagar Dokkhinpara, 5800, Bogra Sadar, Bogra, Bangladesh. For anything on this page, email [email protected]. I read and answer it myself.

If you run the free website check

• What the check does: it loads your homepage once, looks at the security certificate, asks DNS for the site's address, reads the public domain registration record, asks three blocklists (Spamhaus, SpamCop, Barracuda) about the server's IP address, and asks VirusTotal about the domain. These are the same public requests any visitor or search engine makes. It does not scan ports or try to log in.
• What I keep: the website address, the report (findings, grade, time), and a private link to that report. I keep these until you ask me to delete them.
• Your IP address is used in memory to stop the check being run too often from one network. It is written to the security log only if that limit is exceeded, and that log is deleted after 90 days.
• Like any web server, ours also writes standard access logs (IP address, page, time). They are rotated by the server automatically.

If you ask me to contact you, or ask for a quote on a fix

• What I keep: your email, your name if you give it, your message or note, which finding you asked about, the exact consent wording you saw, and the time.
• Why: to reply to you about that request. Nothing is sent to you automatically and you are not added to a newsletter.
• How long: until you ask me to delete it, or until the conversation is over and I close it.

If I emailed you first

• I found your business address on your own website, where it is published for enquiries. I keep a log of what was sent and when for 365 days.
• If you open a report link I sent you, I note that the report was opened (the website and the time, not your IP address or browser). Those notes are deleted after 365 days.
• Reply "no" or use the unsubscribe link and your address goes on a do-not-contact list. I keep that list permanently, because deleting it is how people get emailed again by mistake.

If you are a customer

• Your account: name, email, password (stored only as a one-way hash), and the alert contacts you choose (email, and Telegram or WhatsApp if you add them). Kept while you are a customer.
• Monitoring results: individual checks for 30 days, the alert log for 90 days, resolved issues for 180 days. Open issues stay until they are fixed. Change detection stores a fingerprint of your homepage (a hash, its title and its size), not the page itself.
• Server monitoring, only if you install the agent: server health figures for 30 days, and the latest report only for the rest. If you switch on log collection: web requests 7 days, slow database queries 14 days, SSH sign-ins 30 days. Web logs contain your visitors' IP addresses, so leave it off unless you need it.
• Invoices and payments are kept as accounting records. No card details are ever collected; billing is by invoice.
• Sign-in: a session cookie, only after you log in, that lasts 12 hours. The public pages set no cookies, and there are no analytics, ads or tracking pixels on this site or in my emails.

Who else sees it

• The blocklists, VirusTotal, and the public domain registration service (rdap.org) see the website address or the server's IP address, never your name or email.
• For customers' monitored websites, Google Safe Browsing may also see the website address.
• Alerts and reports go through my email provider, and through Telegram or Twilio (WhatsApp) only if you choose those channels.
• Everything is stored on a rented server (a VPS) that I run. Nothing is sold or shared for marketing.

Backups

A copy of the database is made every night and each copy is kept for 14 days. Something deleted from the live system therefore disappears from the backups within 14 days.

Care-plan clients only: the backups we keep of your website or server can contain your own customers' data (for example, orders or form entries stored in your site's database). They are kept encrypted, and for at most 3 months.

Seeing, correcting or deleting your data

Email [email protected] from the address concerned, or tell me the website. I will send you what I hold, correct it, or delete it, and confirm by email, within 30 days and usually much sooner. Deleting a customer account removes its sites, check history, issues and logins together.

Changes

If this page changes, the date at the top changes. If a change affects customers, I will email them about it first.