Fluid Attacks policy on data retention | Fluid Attacks

Retention

As a company, ensuring the integrity of the services we provide to our users is vitally important. Therefore, when we delete a group on our platform, we retain specific data that contains valuable information about the history of that group, always respecting and guaranteeing the confidentiality of this information. This practice is essential to maintain the integrity of our operations and services. It reinforces our ability to provide quality service.


We will show below which fields are kept in our database after deleting a group in our platform.

  1. From the organization and group created:

    1. Creation date

    2. Language

    3. Country

    4. State info: i.e. active services, modification dates

    5. Code languages info: i.e LOC


  1. From registered repositories:

    1. Creation date

    2. Code languages info

    3. Type: i.e git repository, URL, IP


    1. From the TOE surface (lines, ports):

      1. Attack date

      2. Attacker email

      3. First attack date

      4. Whether it has vulnerabilities

      5. Discovery date

      6. For ToE Lines:

        1. Lines of Code

        2. Attacked Lines

        3. Sorts risk level


      1. Of the typologies found (findings):

        1. Title

        2. Severity: CVSS v3.1 vector string, base and temporal score, CVSSF

        3. Requirements

        4. Hacker email

        5. State info


        1. Of the vulnerabilities found (locations):

          1. Type: i.e. input, line, port

          2. Severity: CVSS v3.1 vector string, base and temporal score, CVSSF

          3. Machine method, if applies

          4. Info regarding state, treatments, verifications y "zero risk" requests


          1. Of the events in the group:

            1. Creation date

            2. Created by (email)

            3. Event date

            4. Hacker email

            5. Solution reason

            6. Solving date

            7. State info

            8. Type


            We do not store any information related to:

            1. Personal info: email, names, phone numbers, etc. In this regard, any external email is deleted if it is present in any other fields mentioned above.
            2. Repositories
            3. Credentials
            4. Detailed info of vulnerabilities: paths, specific lines, commits, snippets, etc
            5. Comments or observations