← Back to OriSignal

Privacy Policy

Last updated: October 6, 2026

This Privacy Policy explains what information OriSignal, a product of ORI Technology ("ORI Technology," "we," "us"), collects through the OriSignal threat intelligence and attack surface platform (the "Service"), how we use it, and who we share it with. It applies alongside our Terms of Service.

1. Information we collect

Account information. When you sign in, our identity provider gives us your email address and display name. We store this along with your organization membership and role.

Indicators you submit. Domains, IP addresses, and other indicators you look up or scan. This is the core input the Service needs to do its job.

Billing information. Handled directly by Stripe, our payment processor. We receive your subscription plan and status, not your card details.

Usage and log data. IP address, timestamps, and the actions taken on your account, kept for security auditing and abuse prevention.

2. How we use it

To run lookups and scans and show you the results; to generate AI risk summaries; to bill your subscription; to enforce rate limits and plan restrictions; to investigate abuse or unauthorized scanning; to send service and security notifications; and to maintain and improve the Service. We don't sell your data, and we don't use Customer Data to train third-party AI models beyond generating your own summaries.

3. Who we share data with

Running a lookup means sending the indicator you submitted to a third-party source to get a result — that's inherent to how the Service works. We share data with categories of service providers, each limited to what they need to do their job:

  • Threat intelligence and vulnerability data providers — receive the indicator (domain, IP, URL, or hash) you submit for a lookup, to return reputation and vulnerability data about it. For URLs, signed-in lookups send the full URL you enter. The free public checker removes the query string (everything after the question mark) before checking, because links often contain private tokens. The free public checker also checks the domain, and for links the path without the query string, against Google Web Risk, so that information is sent to Google to return a malware and phishing verdict.
  • AI service providers — generate the plain-English risk summary from your lookup or scan results.
  • Payment processing — handles your subscription payment and payment method; we never see or store full card numbers.
  • Error monitoring — receives error and crash reports from our own application to help us fix bugs; this can include technical context like request paths, not your indicator data.
  • Infrastructure and hosting — runs the servers the Service is built on.

We don't share data with anyone else except as required by law or to protect the rights and safety of OriSignal, our users, or the public. A full list of the specific vendors within each category is available on request at legal@orisignal.com for customers who need it for their own compliance review.

4. Data retention

We keep account and organization data for as long as your account is active. Lookup and scan history is kept so you can review past results, and you can delete individual results from your dashboard. Audit logs are kept for security purposes for a limited period after the activity they record. If you close your account, we delete or anonymize your personal data within a reasonable period, except where we're required to keep it longer (for example, billing records for tax purposes).

5. Security

Traffic to the Service is encrypted in transit (TLS). API keys are never stored in plain text — only a salted hash, the same principle used for passwords. Access to production systems is restricted, and we run regular backups. No system is perfectly secure, and we can't guarantee absolute security, but we take these protections seriously — it's the same standard we'd expect from a security vendor.

6. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can update your account details or delete lookup/scan history directly in the dashboard. For anything else — including full account deletion — contact us at legal@orisignal.com, and we'll respond within a reasonable time.

7. Cookies and sessions

We use a small number of cookies required to keep you signed in and to protect against cross-site request forgery. We don't use advertising or cross-site tracking cookies.

8. Children's privacy

The Service isn't directed at, and we don't knowingly collect information from, anyone under 18. If you believe a minor has provided us with personal information, contact us and we'll delete it.

9. International users

ORI Technology is based in the United States, and data is processed and stored there. If you're accessing the Service from outside the U.S., your information will be transferred to and processed in the U.S.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through the Service before they take effect.

11. Contact

Questions about this policy or your data? Reach us at legal@orisignal.com.