Privacy & Data Protection Policy

Aegis performs strictly read-only, non-intrusive TLS handshakes, HTTP header inspections, and public DNS lookups on domains you explicitly authorize. We never transmit exploit payloads, fuzz parameters, or execute remote application code.

When inspecting HTTP Set-Cookie headers, Aegis automatically strips and redacts all raw cookie values (<REDACTED>) in memory before generating evidence or persisting reports. Developer API keys are hashed with SHA-256 and never stored in plaintext.

All scan reports, scheduled monitors, and security audit logs are strictly isolated to your workspace account and automatically pruned according to your subscription tier retention window (7, 90, or 365 days).