Varaxon TechnologiesSign in

Varaxon Technologies LLC — Privacy Policy

Document set version: v3.5, effective October 27, 2026
Last updated: October 27, 2026
Company: Varaxon Technologies LLC
Contact: support@varaxontech.com
Service domains: varaxontech.com and scan.varaxontech.com

This Privacy Policy explains how Varaxon Technologies LLC ("Varaxon," "we," "us," or "our") handles personal information when you visit our marketing site, use Varaxon Scan Hub, create an account, connect a third-party system, contact support, or use related services.

Varaxon Scan Hub is intended for customers in the United States, both businesses and individuals. We do not market the service as available in the EU, United Kingdom, Switzerland, Iceland, Liechtenstein, Norway, or Canada. If our customer geography changes, we will update this policy and the applicable terms before expanding the service.

In short: we use your scan data only to produce your reports and related features; we send a pseudonymized version of it to Anthropic so its Claude AI models can help read, enrich, and write those reports (our own support work with Claude can see the real data when a task needs it, as described below); we store your findings and reports in Supabase for your organization only; we delete raw uploaded files within 7 days; and we do not sell personal information, share it for cross-context behavioral advertising (apart from the optional advertising measurement on our marketing site, which stays off unless you accept it), or let anyone train AI models on your scan data.

Information we collect

Account information

When you create or use an account, we collect:

  • your email address, the name you give, and your organization's name;
  • the record that you accepted the Terms of Service and Privacy Policy when you signed up, including the version and fingerprint of the documents you accepted, which we keep after your profile is deleted for as long as your organization's account exists;
  • your password, which Supabase Auth stores only as a one-way hash, and the multi-factor authentication (MFA) factor you enroll;
  • your role in your organization (owner, admin, or member) and the dates your account was created and confirmed;
  • if someone in an organization invites you, the email address they entered, the organization and role you were invited to, and when. We use your address to send you the invitation email. Until you accept, the organization's owners and admins see your address as an open invitation; if they cancel it, or remove you later, your sign-in and these details are deleted;
  • for each upload API key an owner or admin creates, its name, a short prefix that identifies it, who created or revoked it, and when it was last used. The secret part of a key is shown once when it is created; we store only a one-way hash of it;
  • sign-in session records kept by Supabase Auth; and
  • support messages and other information you choose to send us.

Business contacts

If we contact you about Scan Hub before you have an account, we got your name, work email address, job title, and company from a business-contact database (Apollo.io) or from a request you made through Microsoft Marketplace or the ConnectWise Marketplace. We use it only to email you about Scan Hub, and we keep a record of what we sent and any reply. Reply to any of our emails, or write to support@varaxontech.com, and we will stop contacting you and delete your details, keeping only what we need to make sure we do not contact you again.

Billing information

We do not collect or store payment-card numbers, security codes, or full payment-instrument details. Card entry and payment processing happen on Stripe's hosted checkout. From Stripe we receive a customer identifier, subscription identifier, plan, renewal date, payment status, and the record that you accepted our terms at checkout, including the version and fingerprint of the documents you accepted. We also keep a ledger of report credits and of reports counted against your plan. Stripe's privacy information is at Stripe's Privacy Center.

To grant a free trial only once, we keep a keyed one-way fingerprint of each email address that has received one. We treat common variations of an address (for example a "+tag" or, for Gmail, dots in the name) as the same address. The fingerprint cannot be turned back into the email address and is kept after the account is deleted.

Scan data and reports

Scan Hub processes the data you give it to produce reports. This Customer Data can include hostnames, IP and MAC addresses, ports and services, operating systems, installed software, user or account names that appear in scanner output, vulnerability identifiers and descriptions, and other security information about the systems you assess. It reaches us in four ways:

  • Uploads. Files you upload, such as Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp Suite, or Microsoft Defender exports, TLS audits from SSL Labs, sslyze, or testssl.sh, or other CSV, XML, or JSON exports from network, host, or web vulnerability scanners.
  • The upload API. Files your own systems send to Scan Hub with an API key your organization created.
  • Connections you set up. Data Scan Hub pulls from Microsoft Defender Vulnerability Management or ConnectSecure when you choose Build report, or on an automatic schedule (every day, week, or month) that an owner or admin turns on, described below under "Third-party connections."
  • Information you enter. Client names, ticket edits, settings, and the report branding you choose: a "Prepared by" name, a "Prepared for" name per client, and logo images you upload.

Customers must upload or connect only data they are authorized to process. The Terms of Service restrict the categories of data you may submit: unless a separate written agreement is in place, the service does not accept protected health information, payment-card data, classified or controlled government information, export-controlled technical data, or personal data subject to European Union, United Kingdom, or Swiss transfer restrictions.

People who sign a risk acceptance

When one of our customers asks a person at its own client to sign a risk acceptance, we receive that person's name, job title, and email address from our customer. When they open the link and sign or decline, we record the name they type, the date and time, their IP address and browser, and the exact wording they agreed to. We use this only to deliver the request and to keep a record our customer can show later. It is part of our customer's Customer Data, and our customer decides who receives requests. It is never sent to an AI model.

Operational and security information

The application uses only the cookies Supabase Auth needs to keep you signed in; it does not use advertising or analytics cookies. The sign-up, sign-in, and password-reset pages, the free pre-flight check, the free file check on the upload page, and the free email check on our website use Cloudflare Turnstile to block automated abuse, which processes your IP address and browser information for that check. The upload API, the pre-flight check, and the free email check also use your IP address to enforce rate limits; it is held only in server memory for that purpose and is not stored. We keep an activity log of security-relevant actions in your organization, such as members joining or leaving, role changes, settings changes, connections added or removed, data pulls and failed pulls, ticket approvals, API keys created, revoked, or presented after revocation, reports requested through the API, data exports, and deletions. Owners and admins of your organization can download it with the data export described below. Our application logs are limited to operational data such as job identifiers, timings, counts, status codes, and error types, and are designed not to contain scan contents, findings, or report text. When something in the application fails, an error report goes to Sentry so we can fix it: the type of error, where in our code it happened, the page path or job identifier involved, and the error message with email addresses, IP addresses, hostnames, web addresses, and access tokens removed. Error reports do not include scan contents, findings, report text, files you upload, request contents, cookies, or who you are.

Free pre-flight check

Anyone can check a file at the pre-flight page without an account. The file is read in server memory to show what Scan Hub would find in it, and is then discarded: it is not stored, it is not sent to Anthropic or any other AI provider, and no report is made. The check uses Cloudflare Turnstile and IP-based rate limits as described above.

Email and domain checks

When you run an email and domain check, the service reads public records about the domains you enter (your client's domain and any supplier domains) and about lookalike names it generates from them. It sends those domain names, and nothing else from your account, to public DNS resolvers (Google Public DNS and Cloudflare DNS) and to the public registration (RDAP) services of domain registries, the same lookups any internet user can make. If a domain publishes an MTA-STS policy, the service fetches that one public web page. No server is scanned and no email is sent. The domains you checked and the results are stored in your organization like your reports.

Anyone can also run a check without an account at the free email check on our website (varaxontech.com/email-check). The domain names entered are looked up in the same way and the result is shown on the page. The result is kept in server memory for up to 10 minutes, so that checking the same domains again does not repeat the lookups, and is then discarded: it is not stored, not linked to you, and not sent to Anthropic or any other AI provider. Our logs do not record the domain names. The check uses Cloudflare Turnstile and IP-based rate limits as described above.

How we use AI

Scan Hub uses Anthropic's Claude models, through Anthropic's commercial API, to:

  • read files whose layout it does not already know, by working out which columns or fields hold which information and, for an export whose findings sit in an unusual structure, where in the file the findings are. A report read this way says so in a "How this export was read" note;
  • enrich findings by reasoning over our own local database of public vulnerability intelligence (such as CISA's Known Exploited Vulnerabilities catalog and EPSS scores); and
  • write reports, proof pack summaries, and draft tickets, using facts our software has already checked.

What Anthropic receives. Before anything is sent, our software replaces hostnames, IP addresses, MAC addresses, email addresses, and fields that name a host, user, client, or tenant with placeholders such as HOST-0001. The table linking placeholders back to real values stays on our servers and is never sent. For file reading, the file's field names, the location and size of each set of records in it, and a sample of records are sent: up to 22 records to work out the columns, and two records from each candidate set to find where the findings are. For a file with 22 records or fewer, the sample can be every record in it. The rest of the file is read by our software alone. For enrichment and writing, a summary of findings is sent, with your organization's "Prepared by" name so the report can name it. For a proof pack summary, the pack's counts and dates, up to ten issue titles of each kind, and your "Prepared by" name are sent; your client's name, risk acceptance reasons, and anything about the people who accepted a risk are not. You can turn the AI summary off for any pack. Public vulnerability identifiers (such as CVE numbers), finding titles, fix descriptions, and the field names in your export are sent as they are. Placeholder replacement is automated and works on recognized patterns and field names, so we describe it as a strong safeguard rather than a guarantee: unusual free text in an export could reach Anthropic unreplaced.

What Anthropic does with it. Under Anthropic's commercial terms, Anthropic does not use our API inputs or outputs to train its models. Anthropic automatically deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policies or comply with law. See Anthropic's Privacy Center.

AI output can be wrong. Our software checks the AI's claims against its own records, drops enrichment claims it cannot verify, and rejects a draft report that fails its checks. The overall risk ranking, the priority of each ticket, and the ratings in a TLS audit report are calculated by our software from fixed rules, not chosen by the AI. If the AI's draft is rejected, the report is built by our software alone, without AI-written text. You should still review reports and tickets before relying on them.

Our own use of Claude. Varaxon also uses Anthropic's Claude as a tool to run, maintain, and support Scan Hub. When we investigate a support request, a failed report, or a security event, that tool can read the records involved, including account details and scan data with real hostnames, without the placeholder replacement described above. We use it only for the task at hand, under Anthropic terms that do not allow Anthropic to train its models on that data.

We do not use your scan data to train any AI model, and we do not allow our providers to do so.

Third-party connections

You can choose to connect Scan Hub to other systems. Each connection is set up by someone in your organization and can be removed at any time.

  • Microsoft Defender Vulnerability Management. An administrator of your Microsoft tenant approves Varaxon's "Varaxon Scan Hub" application for that tenant. It requests only read-only access to vulnerability, software, security recommendation, and device information through the Microsoft Defender for Endpoint API. It has no access to email, files, or other Microsoft 365 data. To confirm which tenant is being connected, the administrator signs in to Microsoft once using Microsoft's basic sign-in permissions; we show the administrator's name on screen and do not store it. The data pulled includes device names, operating systems, internal and last external IP addresses and other device details, installed software, vulnerabilities, and security recommendations. Scan Hub stores your tenant identifier and Microsoft cloud type; it holds no password or secret from your organization. You can disconnect in Scan Hub, and your administrator can also revoke the application in Microsoft Entra ID at any time.
  • ConnectSecure. You provide your ConnectSecure pod, tenant name, API client ID, and secret. They are stored together, encrypted, in Supabase Vault, readable only by our server, and deleted when you remove the connection. Each pull is limited to the ConnectSecure company you map to a client.
  • HaloPSA and ConnectWise PSA. You provide API credentials for your PSA, stored encrypted in Supabase Vault and deleted when you remove the connection. Scan Hub drafts tickets from a report, and nothing is sent to your PSA until someone in your organization reviews and approves the drafts. Approved tickets contain the remediation details from the report, including the real names of affected hosts, because their purpose is to tell your technicians what to fix.

Each pull from Microsoft Defender or ConnectSecure, whether you start it with Build report or an automatic schedule starts it, builds a report and is paid for like any other report, as the Cancellation and Refund Policy describes. Data that Microsoft, ConnectSecure, or your PSA holds is governed by your agreements with them. Removing a connection stops future pulls or tickets; reports and findings already created stay until you delete them.

How we use information

We use information to:

  • create and secure accounts, including enforcing MFA;
  • produce reports, track findings over time, and provide the features you use;
  • administer subscriptions, report allowances, credits, and billing;
  • send account, security, report-ready, billing, renewal-reminder, and price-change messages;
  • respond to support requests;
  • prevent abuse, enforce limits, and protect the service;
  • comply with legal obligations and resolve disputes; and
  • maintain and improve the service using aggregate operational information.

We do not sell personal information. Apart from the optional Google Ads and Reddit Ads measurement on our marketing site, which loads only after you accept it, we do not share personal information for cross-context behavioral advertising.

Who receives information

These providers process information for us, for the purposes described here:

  • Supabase (United States, East region): our database, sign-in service, and file storage. It holds account records, Customer Data, findings, reports, and PDFs.
  • Anthropic: the Claude AI models described above, receiving pseudonymized Customer Data, and the Claude tool we use to run and support the service, which can see the records involved in a support or security task.
  • OVHcloud (United States region): the servers that run the Scan Hub application and its report workers.
  • Resend: delivery of account, invitation, report-ready, billing, and other service email. Report-ready emails contain the client name you chose and a link to sign in; they do not contain findings, hostnames, or report contents. Risk acceptance sign-off requests contain the signer's name, the client and organization names, the finding's title, and a link.
  • Stripe: payments and subscription billing.
  • Cloudflare: the Turnstile bot check on the sign-up, sign-in, password-reset, and pre-flight pages, the upload page's free file check, and the free email check on our website.
  • Sentry (United States): error reports from the Scan Hub application, limited as described under Operational and security information. They do not contain Customer Data such as scan contents, findings, or reports.
  • Namecheap (Private Email): our business email, including support@varaxontech.com. It holds the messages you send us and our replies.
  • Vercel: hosting for our marketing site at varaxontech.com. It does not receive Customer Data.
  • Google: optional advertising measurement on our marketing site, only after you accept it, as described below.
  • Reddit: optional advertising measurement on our marketing site, only after you accept it, as described below.

We do not give scan data or reports to Google, Reddit, or any other advertising provider. We may disclose information if required by law, to protect the service or others, or as part of a merger, acquisition, financing, or sale of assets, in which case the recipient must honor this policy for information it receives.

Cookies and advertising on the marketing site

This section is the cookie notice for varaxontech.com. The Scan Hub application at scan.varaxontech.com uses only the sign-in cookies described above and does not load any advertising or analytics tag. One choice on the marketing site covers both Google Ads and Reddit Ads measurement.

Necessary storage and saved choices

We save your advertising choice in your browser's localStorage so it can be applied on later visits. It has no automatic expiry: it stays until you change it or clear the site's browser data. The choice is saved separately for each browser and device. When you reject measurement or withdraw consent, we also set __Host-varaxon-ads-denied, a necessary session cookie that records rejection only on the site where you reject. It overrides an earlier accepted choice if localStorage cannot be updated, is not used for advertising, and is cleared when you explicitly accept measurement again. Your browser may restore session cookies when it restores a browsing session.

Optional Google Ads measurement

We use Google Ads for advertising performance and conversion measurement: whether our advertising brings visitors to our site. Google is a third-party provider. Advertising and analytics consent default to denied, and we do not load the Google Ads tag before you affirmatively accept. After you accept, the tag can use cookies and similar identifiers and receive browser and device information, network and IP information, and page or advertising-interaction information. Google Analytics, remarketing, ad personalization, and enhanced conversions are disabled. We do not send email addresses, names, account information, or scan data to Google.

Choose Accept to enable measurement, Reject to keep it off, or Preferences to review your choice. You can later open Cookie preferences in the page footer to withdraw consent, which reloads the page without the Google tag or the Reddit pixel. Withdrawing does not undo information already sent to Google; you can also remove cookies in your browser and use Google's controls. See Google's Privacy Policy, how Google uses information from sites that use its services, and Google's advertising privacy information.

Optional Reddit Ads measurement

We use the Reddit pixel to measure whether our Reddit advertising brings visitors to our site and whether they go on to open our sign-up page. Reddit is a third-party provider. We do not load the Reddit pixel before you affirmatively accept. After you accept, the pixel can set first-party cookies (named starting _rdt_) and similar identifiers and receive browser and device information, network and IP information, the page you visit, the Reddit ad click identifier if you arrived from a Reddit ad, and a sign-up interest event when you click a link to our sign-up page. Reddit may use this information as described in its own privacy policy, including to measure and improve its advertising. We do not turn on Reddit's advanced matching and do not build Reddit retargeting audiences from our visitors. We do not send email addresses, names, account information, or scan data to Reddit.

Withdrawing consent through Cookie preferences removes the _rdt_ cookies we can reach and reloads the page without the Reddit pixel. Withdrawing does not undo information already sent to Reddit. See Reddit's Privacy Policy.

Browser privacy signals

When your browser sends an enabled Global Privacy Control or Do Not Track signal, we treat it as a rejection of optional advertising measurement, even if you accepted earlier, and the Google Ads tag and the Reddit pixel stay blocked.

Retention

  • Raw uploaded files and raw data pulled from connections are deleted automatically within 7 days. On request, we can set a shorter period for your organization, from 1 to 7 days. A scan that is still being processed when its period ends is kept at most one more day.
  • Parsed findings, tracked findings, reports, report PDFs, and proof packs are kept for your organization until it deletes them or closes its account. Owners and admins can delete a client, or a single scan, in the app; this deletes the findings and reports created from it and removes the related uploaded files, PDFs, and logos from storage. Deletions are recorded in the activity log, and a scan cannot be deleted while its report is still being written. You can also ask us to delete data by emailing support@varaxontech.com.
  • Report logos you upload are kept in private storage until you replace or remove them, or delete the client or organization they belong to. Each report keeps its own copy of the logo it was made with, deleted with that report.
  • Risk acceptances and sign-off records are kept with the client they belong to, and are deleted when our customer deletes that client or closes its account. An unused sign-off link stops working after 14 days.
  • Activity-log entries are kept for the life of your organization.
  • Error reports sent to Sentry are deleted automatically when Sentry's retention period ends, at most 90 days after they are received.
  • Account, billing, credit, sign-up-acceptance, and checkout-acceptance records are kept while your organization's account exists, and are deleted from Scan Hub when the organization is closed. Stripe keeps its own records of payments, and of the terms you accepted at checkout, under its own retention rules, and we may rely on those records to meet tax, accounting, and legal obligations, resolve disputes, and enforce our agreements. The trial fingerprint described under "Billing information" is kept after closure.
  • Backups. Supabase keeps daily backups of our database for up to 7 days. Data you delete can remain in those backups until they expire, after which it is gone. Backups are encrypted, are used only to recover from failures, and are not otherwise accessed.

When there is no ongoing business or legal need for information, we delete it or make it anonymous.

Security

All Scan Hub data is encrypted in transit with TLS and at rest by Supabase. Database access rules (row-level security) limit each organization's data to its own members, and every user must pass multi-factor authentication before any customer data can be read. Passwords must be strong and are checked against known leaked passwords. Uploaded files and report PDFs are kept in private storage that is reachable only through short-lived links issued to signed-in members. Credentials you give us for connections are kept in Supabase Vault. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your choices and requests

In Account you can change your name, password, and email address, sign out of every browser, and delete your sign-in profile. The Team page in Account shows everyone in your organization with their name, email address, role, and when they joined or were invited; owners and admins use it to invite and remove people. Deleting your profile removes your email, password, MFA factor, and sessions. It does not delete your organization's findings, reports, or billing records, which belong to the organization. The organization's activity log, which owners and admins can see and export, keeps the email address of whoever made each change or was invited or removed, so the record of who did what stays readable after a profile is deleted; it is deleted when the organization closes its account. You cannot delete your profile while you are your organization's only owner, or while you are an owner and the organization's plan is still active: cancel the plan in Plan and credits and wait for paid access to end first.

Get a copy of your data. Owners and admins can download a copy of the organization's data at any time from Export data in Account: one ZIP file of CSV tables and report PDFs covering the organization's settings, members and their email addresses, clients, scans, findings, reports, logos, connections and tickets (never their secrets), API key names, billing and credit records, acceptance records, and the activity log. Raw uploaded files are not included, because they are deleted within 7 days. An organization can start one export every 5 minutes, and each export is recorded in the activity log.

Close your organization. An owner can close the organization from Close account in Account. This permanently deletes the organization with all its clients, scans, findings, reports, PDFs, logos, connections, and API keys, and then the sign-in profiles of the owner and everyone else on the team. It is refused while the plan is still active or a report is being written.

To make any other privacy request, or if you cannot use these controls, email support@varaxontech.com from the address on the account. We will verify the request before acting on it. We may keep information that the law, fraud prevention, security, or dispute resolution requires us to keep, and deleted data leaves our backups within 7 days.

U.S. privacy rights

Depending on your state, you may have rights to know, access, correct, delete, or obtain a copy of personal information, and to opt out of certain processing. Send requests and appeals to support@varaxontech.com. We will not discriminate against you for using these rights. We honor browser privacy signals as described above.

For California purposes, in the last 12 months we have collected identifiers (such as email addresses and, with consent, cookie identifiers on our marketing site); commercial information (such as plan, credits, and report usage); internet or network information (used for security and, with consent, advertising measurement); and the security information contained in Customer Data. We collect them from you, from your connected systems, from Stripe, and, for business contacts, from Apollo.io and marketplace requests, for the purposes in "How we use information." We disclose them only to the providers listed above.

Children

The service is not directed to children under 18, and we do not knowingly collect information from children under 18.

Changes and contact

We may update this policy by posting a revised version with a new effective date, and we will give notice of material changes by email or in the service. Earlier versions remain available. If a security incident requires notice to affected individuals or regulators, we will give it in the manner and time the law requires.

Varaxon Technologies LLC
5372 Washington St
Camp Lejeune, NC 28547
United States
support@varaxontech.com