We collect information needed to operate SecurityScore.me for managed service providers and their organization members. The categories below depend on how you use the service.

Account and organization data

• Name and email address when you create an account or are invited to an organization.
• Organization name, role, membership, and workspace settings.
• Billing and commercial contact details where applicable.

Customer and asset data

• Customer records, monitored assets, domains, websites, and related metadata you add to your workspace.
• Microsoft 365 connection metadata and assessment results from connected tenants.
• Findings, scores, alerts, activity logs, and generated reports.

Technical and security data

• IP address, browser type, device identifiers, and similar technical data for security, abuse prevention, and reliability.
• Authentication events, session data, and audit-style activity where needed to operate the platform.

What we do not collect

We do not store Microsoft 365 or email account passwords. We do not read mailbox content. Where legacy email breach checks are offered, we query third-party breach intelligence using the email address you submit and store only the results needed to display findings and alerts—not the underlying breach corpus.

We use personal data to:

• Provide, maintain, and improve the MSP security posture platform.
• Authenticate users, manage organization workspaces, and enforce access controls.
• Run Microsoft 365 posture assessments, asset monitoring, findings, alerts, and reporting.
• Send service, security, and transactional communications.
• Respond to support requests and investigate abuse or security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We process data based on contract performance, legitimate interests in operating a secure B2B platform, consent where required (for example analytics cookies), and legal obligations.

Our public website and platform use cookies and similar technologies for authentication, preferences, analytics, and security. Details are in our Cookie Policy.

We use service providers to host and operate SecurityScore.me. They process data on our instructions and under appropriate agreements. This may include:

• Supabase — authentication, database, and application infrastructure.
• Vercel — hosting, deployment, and (with consent) aggregated analytics.
• Microsoft — OAuth and Microsoft Graph when you connect a Microsoft 365 tenant.
• Google — analytics and reCAPTCHA when you consent through our cookie banner.
• Email delivery providers — transactional and alert email.
• Third-party breach intelligence providers — only for legacy email breach lookup features, using the submitted email address.

Providers may process data under their own privacy policies. We do not sell personal data.

We apply technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and monitoring. No online service can guarantee absolute security.

If you believe your account or organization workspace has been compromised, contact us promptly at info@securityscore.me.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to certain processing of your personal data, and to data portability or withdrawal of consent where applicable.

To exercise these rights, contact info@securityscore.me. You may also lodge a complaint with your local data protection authority.

We retain personal data for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. When data is no longer required, we delete or anonymize it in line with our retention practices.

SecurityScore.me is operated from the Netherlands. Your data may be processed in the European Economic Area and in other countries where our providers operate. Where required, we use appropriate safeguards for international transfers.

SecurityScore.me is a business platform for organizations and managed service providers. It is not directed at children under 16, and we do not knowingly collect their personal data.

We may update this Privacy Policy as our product, providers, or legal requirements change. The revised version will be posted on this page with an updated last-updated date.

Questions about this Privacy Policy or our data practices: info@securityscore.me. Related policies: Terms of Service and Cookie Policy.