We collect information needed to operate SecurityScore.me for managed service providers and their organization members. The categories below depend on how you use the service.

Account and organization data

• Name and email address when you create an account or are invited to an organization.
• Organization name, role, membership, and workspace settings.
• Billing and commercial contact details where applicable.

Customer and asset data

• Customer records, monitored assets, domains, websites, and related metadata you add to your workspace.
• Microsoft 365 connection metadata and assessment results from connected tenants.
• Findings, scores, alerts, activity logs, and generated reports.

Contact requests

When you use the contact or pricing form, we store your name, email address, message, the type of request, and your IP address and browser user agent (for abuse prevention), so we can reply.

Technical and security data

• IP address and browser user agent in the organization activity log, for security and audit purposes.
• Authentication events, session data, and audit-style activity where needed to operate the platform.
• Product usage events (which features are used), linked to your account when you are signed in. These are recorded by our own servers, not by third-party analytics.

What we do not collect

We do not store Microsoft 365 or email account passwords. We do not read mailbox content. Microsoft 365 connections use read-only permissions. We do not currently query any third-party breach intelligence service. Results of personal email breach checks from earlier versions of the service remain in the account that ran them and are deleted when that account is deleted.

We use personal data to:

• Provide, maintain, and improve the MSP security posture platform.
• Authenticate users, manage organization workspaces, and enforce access controls.
• Run Microsoft 365 posture assessments, asset monitoring, findings, alerts, and reporting.
• Send service, security, and transactional communications.
• Respond to support requests and investigate abuse or security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We process data based on contract performance, legitimate interests in operating a secure B2B platform, consent where required (for example analytics cookies), and legal obligations.

Our public website and platform use cookies and similar technologies for authentication, preferences, analytics, and security. Details are in our Cookie Policy.

We use service providers to host and operate SecurityScore.me. The following providers receive personal or customer data:

• Supabase: authentication, database, and file storage for reports.
• Vercel: hosting and deployment; with your consent, aggregated analytics and Speed Insights.
• Microsoft (Microsoft Graph): reading posture data from Microsoft 365 tenants you connect, and sending every email from the platform (invitations, alerts, digests, reports).
• Resend: sending the welcome email after sign-up (your email address).
• Google: Analytics when you consent to analytics cookies, and reCAPTCHA on the sign-up, contact and pricing forms.
• crt.sh (Certificate Transparency search, operated by Sectigo): the domain names of monitored customers, to find their public TLS certificates.
• Cloudflare and Google public DNS resolvers: domain names of monitored assets, for DNSSEC checks.

Providers may process data under their own privacy policies. We do not sell personal data.

We apply technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No online service can guarantee absolute security.

If you believe your account or organization workspace has been compromised, contact us promptly at info@securityscore.me.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to data portability or withdrawal of consent where applicable.

To exercise these rights, contact info@securityscore.me. You may also lodge a complaint with your local data protection authority.

Export

In Settings, "Export my data" downloads a JSON file with your profile, organization memberships and roles, notification preferences and settings, onboarding state, and any personal breach-check data. Customers, assets, scans and findings belong to the organization; they can be exported per customer as a report. For a copy of other data we hold about you, email info@securityscore.me; we handle these requests by hand.

Deleting your account

You can delete your account in Settings. Your personal data and login are deleted. If you are the only owner of an organization, transfer ownership first. Data your organization owns (customers, assets, scans, reports) stays with the organization.

Deleting a customer

Deleting a customer removes its assets, scans, findings, handled and accepted findings, alerts, reports (including PDF files), report and digest schedules with their recipients, and Microsoft 365 connection tokens. Entries in the activity log that refer to the customer are anonymised, including reasons and owners recorded for accepted risks.

Deleting an organization

The organization owner can request deletion. The organization loses access immediately and is permanently deleted, including all customers, data and files, after 7 days. Until then an owner or administrator can cancel the request.

Microsoft 365 connections

When a customer or organization is deleted, we delete the stored Microsoft 365 tokens. The consent for our application stays in the customer's Microsoft Entra ID until an administrator of that tenant removes the application there; we show how to do this.

Contact requests

On request we delete all contact requests sent from your email address.

We delete data automatically on the schedule below. Data not listed is kept while your organization uses the service and is deleted with your account, the customer, or the organization as described above.

• Activity log: system events 90 days; user actions 365 days; critical security events 365 days. IP address and user agent are removed after 30 days.
• Scans: the detailed scanner output is reduced after 90 days to the scan type, URL, Microsoft 365 tenant ID and scan status, except for the two most recent scans of each asset. Scores and findings are kept for trends and report history.
• Alerts: resolved alerts 365 days after they were resolved; dismissed or archived alerts 365 days after their last change. Open alerts are kept.
• Security events and cases (Microsoft 365 security monitoring): 365 days after they are closed. Cases open for 180 days are marked stale and closed automatically after 365 days.
• Discovered hosts that no longer exist: 30 days after they were last seen.
• Discovered TLS certificates: 90 days after they expire.
• Generated reports and their PDF files: 730 days.
• Contact requests: 365 days after they are closed; other requests 180 days after their last change.
• Email broadcast logs and monitoring notification logs: 180 days.
• Vulnerability notification log: 365 days.
• Usage analytics events: 180 days.
• Monitoring run logs: 90 days.
• Posture drift history: 365 days.
• Microsoft 365 sign-in state: 1 day after it expires.
• Delivery logs of weekly risk digests, scheduled reports and security operations digests: 365 days. These logs record counts and errors, not the message. Recipient email addresses are kept in the schedule until you change them or delete the customer.
• Subdomain discovery run logs: 90 days.
• Handled findings and accepted risks (who marked them, when, the reason and the owner): until a scan no longer finds the issue, or until the customer is deleted.
• Revoked authorizations for active checks: 730 days after they are revoked.

SecurityScore.me is operated from the Netherlands. Your data may be processed in the European Economic Area and in other countries where our providers operate. Where required, we use appropriate safeguards for international transfers.

SecurityScore.me is a business platform for organizations and managed service providers. It is not directed at children under 16, and we do not knowingly collect their personal data.

We may update this Privacy Policy as our product, providers, or legal requirements change. The revised version will be posted on this page with an updated last-updated date.

Questions about this Privacy Policy or our data practices: info@securityscore.me. Related policies: Terms of Service and Cookie Policy.