Privacy on these pages

Scope

This notice covers the PRAE pages at nullventures.co/security/. It also covers Field Kit checkout, payment confirmation, private downloads, and access recovery. Pilot agreements have separate terms.

Where each input goes

• Security starting planStays in your browser. The page evaluates your answers, including anything typed in the optional detail fields, locally. They are not sent to us, not stored in the browser, not put in the address bar and not included in any form. Reloading or “Start again” clears them. Downloading or copying the plan is your decision.
• Field guide formSent to Netlify, which hosts this site and stores form submissions for us. Only your email is required; name and company are optional. Submissions are also emailed to the PRAE mailbox. We use them to know who reads our research. We email you about PRAE products only if you tick the optional updates box.
• Product updates formSent to Netlify and emailed to the PRAE mailbox. We use your email only to tell you when a product you chose becomes available or its planned terms change.
• Contact formSent to Netlify and emailed to the PRAE mailbox. We use what you send to handle your request.
• Page requestsServed by Netlify. Like any web host, it processes your IP address and request details to deliver pages. These pages load no advertising tags, session replay or third-party scripts. The limited first-party interaction counts are described below.
• The benchReads a static file of results recorded from synthetic fixtures. Nothing about you or your system is involved.
• DownloadsOrdinary files. Opening, running or sharing them is up to you. The Ship Kit alpha makes no network requests.

Field Kit purchases and recovery

Stripe and Link handle checkout, indirect tax, payment receipts, payment support, refunds and disputes for purchases sold through Link. Their privacy policy governs that processing. They provide us with the purchase email, billing address, payment status, transaction identifiers, base and paid amounts, currency, and refund/dispute facts. We do not receive your full card number. Netlify hosts the purchase service and private ZIP. Neon hosts the PostgreSQL purchase ledger: orders, billing addresses, payment/refund/dispute facts, accepted terms and delivery-consent wording and timestamps, entitlements, delivery status, hashed tokens, and security records. The transactional email provider, Resend, processes the purchase email and access message when email delivery is enabled. Purchases do not subscribe you to marketing.

Recovery requests use the purchase email to locate eligible orders and send an access link. We return the same message whether or not a purchase exists. Access links expire after 30 minutes, and used links cannot be reused. Recovery requests are removed after processing or expiry. Rate-limit records use hashed identifiers and expire; application logs use order and event identifiers rather than email addresses or access tokens.

Order, payment, policy-acceptance, and delivery records are retained to administer purchases, recovery, and payment reversals. No automatic order-record deletion period has been set. Use the contact form for privacy and deletion requests; some records may need to be retained for payment administration or applicable obligations.

Public Vigilance reports

Vigilance reports and search are free to read. Search terms and filters are sent in the page request URL, so Netlify access logs can contain them. Do not enter private repository names, credentials or sensitive environment details in public search. The registry stores public-source intelligence in Neon and serves only approved public reports.

The optional report orientation keeps your answers in browser memory only. It does not submit them to Null, save them in the URL or browser storage, or enroll you in updates. Resetting or leaving the page clears the answers. Public API rate limits use a daily keyed hash of the requesting IP address. These short-lived counters are removed on subsequent requests after approximately ten minutes; the registry does not store the raw IP address in them. The connected workflow demonstration is synthetic and accepts no uploaded inventory. No advertising tags or visitor profiles are used.

Anonymous interaction counts

When you choose a publication preview, example assessment report or research entry, a first-party request can increment a daily total for that category. The counter stores only the day, category and total in Netlify Blobs. It does not store an IP address, identifier, email, page URL, referrer or assessment answer. It uses no cookies or browser storage. The browser sends no credentials or referrer with this request, and disables it when Do Not Track or Global Privacy Control is enabled. Netlify still processes connection information to serve the request, as it does for other page requests.

The aggregate contains up to 30 days of totals; older totals are pruned when the next count is recorded. These are approximate click counts, not unique visitors or completed purchases. They can include repeat clicks or automated traffic and may miss requests. There is no public endpoint for reading them.

Cookies and storage

Submitting the field guide form sets two cookies on nullventures.co/security/, kept for a year: one signed cookie that lets you open the guide and its downloads, and one that lets the page show you already have access. Neither contains your name or email, and neither is used for tracking. Field Kit checkout uses a signed, HttpOnly, Secure cookie for up to 24 hours to connect the returning browser with its purchase. Confirmed access uses a separate opaque HttpOnly, Secure cookie for 24 hours. Only its hash is stored on the server; signing out revokes that session. These are functional cookies, not tracking cookies. The starting plan stores nothing in your browser.

Keeping and deleting submissions

We have not set an automatic deletion period for form submissions. Ask us to delete yours at any time through the contact form.

What not to send

Do not enter or send passwords, API keys, production records or other sensitive evidence through the starting plan or any form. Describe your product and stack instead.

Implementation reviewed 2 November 2026. This notice will change if these pages add analytics, new forms or different data handling.