Privacy

SelfSec is operated by Rycode. For any privacy question, or to exercise the rights described below, email support@rycode.io.

Your email address, because that is how you sign in — we send a one-time link rather than storing a password.

Your organisation profile — company name, industry, size and similar details you enter, which we use to determine which rules apply to you.

Your assessment answers and the resulting scores, recommendations and remediation board. This is business information about your security posture rather than personal data, but it is confidential and we treat it that way.

We do not use analytics, advertising or session-recording tools, so there is no tracking profile and no cookie banner. The only cookies we set are the ones that keep you signed in.

We process this data to provide the service you asked for — performing the contract between us. Your email is also used to send you the sign-in link, which is necessary for the service to work. We do not send marketing email unless you separately ask us to.

In the EU. Our database and authentication are hosted in Ireland, and sign-in emails are delivered from the EU as well. Data is encrypted at rest and in transit. See our security page for how it is protected and separated from other customers.

We use two sub-processors, both in the EU:

• An EU-hosted cloud database and authentication provider (Ireland), where your assessments are stored.
• An EU email delivery provider (Ireland), used only to send your sign-in link. It receives your email address and the link itself, and nothing else.

Nobody else receives your data. In particular, your assessment answers are never sent to any third-party AI or language-model provider. The named list of sub-processors is available in our data processing agreement (DPA) on request.

We may disclose data if legally required to, and will tell you unless we are prohibited from doing so.

For as long as your account is active, so your assessments remain available and you can track progress over time. Ask us to delete it and we will, then confirm once it is done.

Under the GDPR you can request a copy of your data, ask us to correct it, ask us to delete it, object to how we process it, or ask for it in a portable format. Email support@rycode.io and we will respond within 30 days. You also have the right to complain to your data protection authority — in Sweden, Integritetsskyddsmyndigheten (IMY).

A data processing agreement (DPA) is available on request.

If we change this policy in a way that affects you, we will tell you by email before it takes effect.