Privacy Policy & Data Handling Principles
Effective Date: September 2026 • Version 1.0 • RootLayer Trust Framework
Our Core Privacy Commitments
RootLayer was engineered under the belief that automated security auditing must never compromise user confidentiality. We maintain the following foundational safeguards:
1. Information We Collect
When you use our free scanners or submit an audit request, we only collect the minimum telemetry necessary to process your request:
- Uploaded Files: Temporarily stored in an isolated, non-executable directory solely for the duration of the static inspection.
- Website URLs: Targeted domains submitted for passive HTTP header and TLS inspection.
- Audit Request Data: Contact name, email address, and organization name when requesting an Advanced Audit.
- Cryptographic Hashes: SHA-256 and MD5 hashes calculated locally to index findings.
2. Static Analysis & Zero-Detonation
All file processing is performed purely through static structural parsing (reading binary headers, PDF tokens, and OOXML relationships). We do not provide dynamic sandbox execution or malware detonation. This ensures that your files cannot compromise our host infrastructure and that no dynamic telemetry is shared with external vendors.
3. On-Demand & Automated File Shredding
Our retention worker runs continuous purge cycles. Any file that exceeds the retention window is overwritten with zero bytes and deleted from disk. Furthermore, users can click "Purge Upload" directly on their assessment report to instantly trigger permanent disk wiping.
4. No Data Selling or Commercial Sharing
We do not sell, rent, or trade your uploaded files, contact details, or scan results to any third-party advertisers, data brokers, or threat intelligence platforms.
For questions regarding our privacy architecture, contact our team at privacy@rootlayer.io.