1. Overview
This policy explains what personal data Soracin ("we", "us") collects through soracin.com
and app.soracin.com, why, and your rights. It is written to meet the GDPR and comparable laws.
Soracin is the data controller.
2. What We Collect
- Account data: your email address and, optionally, your name and company or project name.
Sign-in is handled by Amazon Cognito; we never see your password. If you sign in with Google or
GitHub, we receive your name, email address and whether the provider has verified it (GitHub: your
verified primary email, username and avatar). We don't get access to your Google or GitHub data beyond that, and we
don't keep GitHub's access token.
- Connected-account data: the credential you grant for each source (OAuth tokens, admin API
keys, or an AWS role ARN), stored encrypted with AWS KMS and never logged; configuration and billing metadata
read from those accounts (for example project settings, security-check results and daily cost line items),
stripped through an allowlist before storage. We do not read your application data, environment variable
values, secrets, database rows, stored files, or LLM prompts and completions. Details per source are on our
Trust page.
- Alert channel data (Pro): Slack or webhook URLs you add, stored encrypted.
- Transaction data: your plan, billing period and subscription status. Card details are
handled by our payment provider, Creem, and never reach us.
- Technical data: server logs (IP address, request times, errors) used to run and secure
the Service.
- Communications: emails you send us.
3. How We Use It
- To provide the Service: sign you in, scan the accounts you connect, compute findings, drift and spend, and
send the reports and alerts you've chosen.
- To process payments and provide support.
- To keep the Service secure and reliable, and to improve it using aggregated usage information.
- To send product updates only where you've agreed; you can opt out at any time.
- To comply with legal obligations.
No AI/LLM provider processes your data today. If we add one, we will name it in this policy and on the Trust
page before it is used, and only redacted configuration metadata will be sent.
4. Legal Bases
- Contract: to provide the Service you signed up for.
- Legitimate interests: to secure and improve the Service.
- Consent: for marketing emails, which you can withdraw at any time.
- Legal obligation: for tax and accounting records.
5. Retention
- Findings, changes and configuration snapshots: 7 days (Free), 90 days (Indie), 1 year (Pro). Cost records:
30 days (Free), 13 months (Indie), 25 months (Pro).
- Disconnecting a source deletes its credential immediately and its data after 30 days.
- Your account data is kept while your account is open and deleted on request; billing records are kept as
long as tax law requires.
- We never delete your data because a payment failed.
6. Who We Share It With
We do not sell personal data. We use these processors:
- Amazon Web Services (United States, us-east-1): hosting, database, encryption keys and
sign-in.
- Google and GitHub: only if you choose to sign in with them.
- Cloudflare: hosting for the Site and dashboard, DNS.
- Resend: email delivery.
- Creem: payments and subscriptions.
- Google Fonts: web fonts on the Site (your browser requests them from Google).
Alerts you route to Slack or your own webhook are sent to those destinations at your instruction.
7. International Transfers
Our infrastructure is in the United States. Where data moves from the EEA or UK, we rely on our processors'
standard contractual clauses or equivalent safeguards.
8. Your Rights
You can ask to access, correct, delete, restrict or export your personal data, or object to processing based
on legitimate interests, by emailing support@soracin.com. We respond
within 30 days. You can also complain to your local data protection authority.
9. Cookies & Local Storage
The Site sets no tracking or advertising cookies. The dashboard stores your sign-in session in your browser
so you stay signed in; signing out removes it.
10. Security
Credentials are encrypted with AWS KMS, access to your providers is read-only wherever the provider allows
it, and outbound alert requests are checked against private and internal addresses. No system is perfectly
secure; we will notify affected users without undue delay if a breach affects their data.
11. Contact
Privacy questions or requests: support@soracin.com.