Data controller and contact
Jochen Schultz, Buchenweg 13, 53347 Alfter, Germany. Email: datenschutz@debugteam.com. DebugTeam is a private, free project.
Why data is processed
For the monitoring you request, we store your email address, website URLs, notification settings and, where applicable, your webhook destination. We also store public software and version evidence, observation times, HTTP/TLS results and matched security advisories. Processing provides the service you requested (Article 6(1)(b) GDPR). Technical measures to prevent abuse and ensure reliable provision are based on our legitimate interest in a secure service (Article 6(1)(f) GDPR).
Website ownership verification
Before the first website check, we compare the website domain with your verified email domain. If they differ, you can request DNS TXT or meta tag verification in your protected account area. The verification instructions are bound to your account, website and hostname, and are valid for 24 hours. We store a random identifier, verification value, expiry time, verification method and result; the verification code is derived from these only for your protected instructions and verification. Verification queries the public DNS record or public HTTPS homepage. No regular website scan starts without verified ownership. Associated verification data is deleted when the website or account is removed.
Assessments and corrections
In your account area, you can assess detected components and record version corrections with a note. We store this information separately from technical scan observations for each website. It is not automatically published or adopted as a global detection rule, and is deleted with the website or your account. When the scan observation changes, we mark older feedback accordingly.
Your WordPress version
You can specify your WordPress version for each website. This self-reported declaration and its change time are stored separately from automatic observations. It filters clearly inapplicable, unconfirmed WordPress notices in your private view and notification deliveries. A newer, conflicting automatic version observation suspends the filter. You can remove the declaration at any time. Public reports and automatic scores continue to rely on technical observations.
Private software inventory and research notices
When you create a software inventory, we store the products you select with their vendor, version, an optional private label and change time. This list is not published. Product identities are used for comparison with our own NVD/CVE data; email addresses, private labels and your full inventory list are not sent to public CVE providers. Unmapped products remain marked accordingly.
The additional option for our own DebugTeam research notices is voluntary and initially disabled. We store your choice and compare released notices with matching products and versions. You can withdraw this choice in your protected account area. This stops further notifications of this kind; a message already sent cannot be recalled. Removing an entry or account deletes the associated private inventory data.
Confidential security reports submitted through the contact form are processed by the operator for review and coordination with the reporter. They do not automatically enter public advisory lists or participant notifications. Targeted sharing uses only separately reviewed and released information; private technical evidence and contact details are not included in these notices.
Account, sign-in and account security
You use an account with an email address and password for monitoring and pentester profiles. We store the password as an Argon2id verification hash, not in plain text. New accounts must verify their email address. Verification and password reset tokens are single-use and valid for 30 minutes; we store only hashes to verify them. Explicit email verification does not sign you in automatically.
Sign-in uses the technically necessary HttpOnly cookie debugteam_session for a limited session of 30 minutes; over HTTPS it is also Secure. There is no cross-domain tracking. Password changes and resets revoke existing sessions.
You can set up an authenticator app in your protected account area. The TOTP key is stored encrypted. The QR code is generated locally on our infrastructure; no external QR service is called. Setup and sign-in use short-lived verification states. Recovery codes are displayed once and stored server-side only as user-bound verification values. Resetting your password does not disable a configured second factor.
Delivery and vulnerability data
We store your choice of individual vulnerability notices or a weekly digest. The optional summary groups less severe and unconfirmed notices for your own websites. Before sending, we recheck current website observations and security advisories; warnings that have become obsolete in the meantime are suppressed. This setting relates to the monitoring service you requested and is not a newsletter subscription.
Notifications are sent through our own mail server at Hetzner. Automated notifications use a technical sender under notify.debugteam.com. General inquiries are handled by info@debugteam.com and privacy inquiries by datenschutz@debugteam.com. Webhook destinations are used for alerts only after successful verification. CVE assessment uses our own Dependency-Track/NVD data. No participant email addresses or lists of monitored websites are transmitted to public CVE data sources for this purpose.
The website and monitoring run on our own rented server infrastructure provided by Hetzner Online GmbH in Germany. Advertising, external visitor analytics, external fonts and optional embedded media are not enabled. Our own visitor statistics are enabled only with your consent. Security advisories may link to external original sources; these are visited only when you open the link.
Private and public check reports
In your protected account area, you can download reports for your websites individually or together as PDF and JSON. For verified websites you own, you can publicly share a current report after explicit consent. Published data includes the domain without URL parameters, score and deductions, detected components and version evidence, associated CVE notices, and check and data timestamps. Your account email, private correction notes, internal identifiers and webhook data remain private.
You can optionally upload a website logo. It is stored and served on our infrastructure as a size-limited PNG file. The public report remains accessible through its link until you revoke publication or remove the website or your account. Website ownership verification remains a prerequisite; older check results are marked as outdated. No graphic on your website is required. Publication is voluntary and can be revoked at any time in your reports (Article 6(1)(a) GDPR).
Retention and deletion
Unverified registrations are deleted after three days. Expired tokens and sessions are cleaned regularly. Individual HTTP check logs and contact inquiries are retained for at most 90 days, and completed delivery logs for at most 30 days. Ongoing monitoring data is retained until the website or account is removed. Operational backups are encrypted and replaced according to a limited backup schedule; data restored from backups must not undo a previously requested account removal.
Cookie settings
II consent management stores a website-specific choice for 180 days; consent records are removed after 181 days. Required forms work independently of optional consent. You can optionally consent to DebugTeam's own visitor statistics. Only then do we store, for a maximum of 90 days, the time of a visit, the public landing page, the referring domain and, where applicable, UTM campaign details and search terms actually transmitted by search engines. Full referrer URLs, URL parameters outside these campaign details and IP addresses are not stored in the statistics. A random session identifier remains in your browser's session storage until the tab is closed or consent is withdrawn. To briefly limit abusive requests, an IP-derived identifier generated with a secret key is used for one minute; expired entries are cleaned regularly. Analysis takes place on our own infrastructure and is accessible only to the operator. You can withdraw consent for future collection at any time in the cookie settings. WordPress administration sessions are restricted to authorized operators.
Technical logs and abuse prevention
Servers process technically necessary connection data, such as IP addresses, request times and error states. To limit form submissions, the application uses an IP-derived identifier generated with a secret website key. Access and API keys are not intentionally included in public logs. The service sends limited HTTP requests to websites you register; their operators process the resulting connection data under their own responsibility.
Pentester profiles
When you voluntarily create a profile, we process your email address for verification and management, along with the profile details you enter. Your display name, headline, description, specializations, region, languages, remote availability and optional website link become publicly visible only after you verify your email and explicitly choose publication. Your email address and administrative data do not appear in the public directory. Profile details are self-reported; email verification is not a qualification check. You can edit, hide or delete your profile. These functions form part of the directory service you requested. We do not publish profiles automatically merely because someone submits a contact request.
Introductions
The contact form stores your name, email address and message to process your inquiry. Sharing with a specific contact is agreed separately. The inquiry itself does not authorize anyone to perform a penetration test. Depending on your inquiry, processing takes place to prepare a requested service or on the basis of our legitimate interest in answering your message.
Your rights
Within the scope of applicable law, you can request access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests. You can withdraw consent with effect for the future. You can also complain to a data protection supervisory authority. Contact for these requests: datenschutz@debugteam.com.
You can remove your websites and account directly under Manage websites .