Privacy Policy

Last updated: November 3, 2026

1. Introduction

FirmwareShield ("we", "us", "our") operates the firmwareshield.io website and the FirmwareShield firmware security analysis platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

2. Information We Collect

Account Information

When you create an account, we collect your email address and, optionally, your name. We store a hashed version of your password -- we never store passwords in plain text.

Firmware Data

When you upload firmware images for analysis, we temporarily store the binary file in encrypted cloud storage (Cloudflare R2). Firmware files are automatically deleted 7 days after the analysis completes, or immediately when you delete them. Analysis results (reports, SBOMs, component lists, vulnerability findings, compliance scores) are kept until you delete them, for at most 12 months. Secrets detected in firmware (such as hardcoded passwords or keys) are stored only in masked form together with a keyed hash; we never store the secret value itself.

Usage Data

We collect anonymized usage analytics including page views, feature usage, and scan counts to improve our service. We do not track you across other websites.

3. How We Use Your Information

  • To provide and maintain the firmware analysis service
  • To process your per-report payments and invoices
  • To send scan completion notifications and security alerts
  • To improve our analysis accuracy and service quality
  • To comply with legal obligations

4. Data Sharing

We do not sell your personal data or firmware analysis results. We share data only with:

  • Stripe -- for payment processing
  • Cloudflare -- for hosting, CDN, object storage, and transactional email delivery
  • Sentry -- for error tracking (anonymized)

5. Data Security

All data is encrypted in transit (TLS 1.3) and at rest. Firmware files are stored in isolated, encrypted buckets. We follow OWASP security best practices and conduct regular security reviews of our platform.

6. Data Retention

  • Firmware binary files: deleted automatically 7 days after the analysis completes, or immediately when you delete them
  • Reports, SBOMs and findings: kept until you delete them, and automatically deleted after at most 12 months
  • Detected secrets: stored only masked, together with a keyed hash -- never in plain text
  • Payment records: kept as long as required by tax law. Stripe holds your card data; we keep only invoice metadata
  • Account data: kept until your account is deleted. To delete your account, contact us at privacy@firmwareshield.io

7. Seller sign-ups (experiment)

From November 2026 we run a short experiment with a page for brands that sell smart devices under their own name (firmwareshield.io/sellers). This section covers only that page.

What we collect

  • What you enter in the sign-up form: email address, company or brand, product category, marketplaces, number of products, whether you have the firmware file, whether you would pay for monitoring, your note, and your consent to be contacted
  • A count of page views, each stored only with the page version shown and the campaign source of the link (for example "reddit"). We set no cookies on this page and do not store your IP address or browser details
  • The sign-up form uses Cloudflare Turnstile to stop bots. Cloudflare processes your IP address for this check; we do not store it

Why

To contact you about the experiment and to learn whether our service is useful to sellers.

Legal basis

  • Contacting you after you sign up: your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time by writing to privacy@firmwareshield.io
  • Bot protection (Turnstile) and the anonymous page-view counts: our legitimate interest in keeping the form free of spam and in measuring the experiment (GDPR Art. 6(1)(f))
  • Cloudflare acts as our processor for hosting, Turnstile and email delivery (see section 4, Data Sharing)

How long we keep it

Sign-up data is deleted by 30 June 2027, unless you become a customer, in which case the account terms above apply.

Deletion

To have your sign-up deleted earlier, write to privacy@firmwareshield.io.

8. Your Rights (GDPR)

If you are in the European Economic Area, you have the right to access, rectify, erase, restrict processing, data portability, and object to processing of your personal data. To exercise these rights, contact us at privacy@firmwareshield.io.

9. Contact

For privacy-related inquiries, contact us at privacy@firmwareshield.io.