DanSec Reports

Privacy

This page explains what DanSec Reports does and does not do with your data. It's written plainly - not by a legal team.

What stays on your device

  • Report content - all of it. Titles, text, findings, IOCs, timelines.
  • Branding profiles, logos, and colour settings.
  • Evidence images and attachments.
  • MITRE ATT&CK mappings.
  • Autosaves in IndexedDB.
  • .dansec files saved to your chosen location.

What is sent to our server

Only when you click "Export PDF".

  • The document JSON and branding data needed to render the PDF.
  • This is held in memory for the duration of the render (a few seconds), then discarded.
  • Not logged. Not stored on disk. Not backed up. Not retained.

What we log

  • PDF render duration, page count, success or failure - for capacity planning only. No content.
  • Standard HTTP access logs at the Railway proxy layer: IP, path, timestamp. Short retention window.

Analytics

We use self-hosted Umami for analytics. It collects pageviews and anonymous event counts (e.g. "pdf_exported", "report_created"). No IPs stored, no fingerprinting, no cross-site tracking.

Umami respects Do Not Track. If your browser sends DNT, Umami will not record the visit.

The short version

No accounts. No cookies beyond session essentials. No third-party trackers. No AI processing of your content. Your reports are yours - they live in your browser and in the files you save.

A formal Terms of Service will accompany the full launch. This privacy page is owned by the product, not a legal team - it's meant to be readable by a human.