Privacy

This page is how HostCloak handles operator data today. We do not claim PCI, SOC 2, or any other certification. The product name in use is HostCloak on hostcloak.com.

What we collect

• Account email. Magic-link sign-in address for your operator account.
• Scan targets. The DNS name or IP you name, plus the fact that you asserted authorization.
• Reports. Public-surface metadata of those hosts (port reachability, certificate fields, HTTP headers and well-known path presence, DNS records when relevant) and the posture grade / fix order we produce.
• Live Deck (opt-in, paid plans). CPU, memory, disk, and net counters from an agent you install. Metrics only. Not a remote shell.
• Billing identifiers. Stripe customer and subscription IDs when you upgrade — not full card numbers.

What we do not store

No root passwords stored. We do not request a root password, sudo password, or SSH private key. Do not paste them into support mail, tickets, or report comments. Account login is yours — it is never used against a customer machine.

Billing

Paid plans use Stripe Checkout. We keep Stripe customer and subscription identifiers so the app can open the customer portal and enforce plan caps. Card numbers stay with Stripe. Stripe secret keys are not stored in git.

What we do not claim

This is not a PCI assessment, not SOC 2, and not an audit letter. A HostCloak grade is a defensive posture snapshot for operators, not a certification you can show a bank or an auditor.

Contact

Questions or data requests: privacy-protected operator inbox. Related: Terms, AUP, Abuse.