Auto VDP (autovdp.cetome.com) is a free tool by cetome to generate and analyse vulnerability disclosure policies. This policy covers this site only. For cetome.com, see the cetome.com privacy policy.
1. Data we collect
- Analyses: when you analyse a website, we record the address you entered, the result of the analysis, your IP address, your browser and the time, even if you do not give us an email address. We use it to understand how the tool is used and which organisations are checked.
- Generated policies: when you generate a vulnerability disclosure policy, we record the company name, the security contact address and the timelines you entered, with your IP address, your browser and the time. The contact address is the one you put in your policy: we do not add it to our contacts and we do not write to it.
- Reports: the full report of an analysis is sent by email. We email a private link to the address you give us, and we record that address, which analysis it was for, your IP address, your browser, and whether and when you opened the report and downloaded its PDF. This is a commercial purpose: we use it to know who uses our tools, and we may write to you about our services. The address joins cetome's contacts, the same as for a document requested on cetome.com.
- Contact form: the name, email address, subject and message you send are emailed to us so we can answer. They are not stored on this site.
- Server logs: our host records your IP address, browser, the page requested and the time, for technical and security purposes.
- Call bookings: the "book a call" link takes you to Calendly, not this site. Whatever you enter there is held by Calendly under its own privacy policy, and we receive the appointment and the details you chose to give.
2. How we use it
- Run the analysis or generate the policy you asked for, and send you the report you asked for.
- Answer your messages, and write to you about our services after you asked for a report. Tell us to stop and we stop. We do not run a newsletter and you are not subscribed to one.
- Improve the tool from how it is used.
- Protect the site against abuse.
- We never sell, rent, resell or otherwise trade your personal data, to anyone, for any purpose.
3. Artificial intelligence
Auto VDP uses an AI service to read the vulnerability disclosure policy of the website you analyse, and every result says so. The AI service receives the public text of that web page and nothing about you: not your email address, not your IP address and not your browser.
4. Cookies and security
Auto VDP sets no cookies, nor any other identifier stored in your browser, which is why it shows no cookie banner. The link to a report works on its own, without a cookie. Fonts and scripts are served from our own server, never from a third-party host, and there is no audience measurement on this site.
- ALTCHA: every form that takes an email address is protected by a self-hosted ALTCHA check, a proof-of-work puzzle solved in your browser and verified on our own server. Nothing is sent to a third party.
- Rate limits: the forms limit how often one IP address can use them. That count is kept only for the short limiting window.
5. Sharing
We never share your personal data with third parties for their own purposes. The only companies that handle it are the ones that run our infrastructure, such as our hosting provider, and they act on our instructions alone. Nothing about you is passed to the websites you analyse, beyond the visit our tool makes to their public pages.
6. Storage and retention
- Encryption: all communication with this site is encrypted with TLS.
- Location: data is stored on servers in the European Union.
- Retention: we keep personal data for 12 months at most, after which it is deleted automatically. A report link stops working after 7 days.
7. Your rights
Under the GDPR, you have the right of access, rectification, erasure, restriction of processing, objection to processing and data portability. We answer within 30 days. Use our contact form and tell us the address you used: we delete every record of it, including your report links.
8. Data controller
The data controller for this website is cetome:
- UK: cetome Limited, registered in England and Wales, No. 11074299
- France: Cédric LEVY-BENCHETON EI, SIRET 849 836 101 00014
- Contact: our contact form