Privacy Policy

This policy explains how information is handled on the Quantix Security Labs website. In it, “Quantix”, “we” and “us” mean the operator of this website, which decides how and why the information described here is processed.

The data handling described here is how this website’s code processes what you send (see also Trust & Security). Any personal data processed during a security engagement is governed by the written agreement for that engagement.

The website collects information only when you submit one of its forms, use one of its security tools or sign in as staff. Each form sends exactly the fields listed below; nothing else is read from your browser or device.

With each submission the server records a reference number, the time it was received and, where it applies, a note that the email address belongs to a free email service (used only for triage). Two hidden values are checked to filter automated submissions: an empty trap field and the time the form was opened. They are discarded after the check.

Security tools. When you use the Token Scanner, Address Intelligence, the Transaction Graph or the Contract Analyzer, the server processes the network, the addresses and — for the analyzer — the source code or public repository address you submit. On this deployment the request and its result are stored in the database so the result can be opened again and downloaded; results are identified by an unguessable id. Submit only code you are entitled to share.

Staff accounts. For people who sign in to the admin panel or audit workspace, the database holds their email address, optional name, a password hash (scrypt; the password itself is never stored), sign-in times, and a one-way hash of the IP address used for each session and security-relevant action.

Please do not submit private keys, seed phrases, passwords, API credentials or personal data about other people. Vulnerability reports should follow the reporting guide.

Hosting logs. The hosting platform that serves the website records standard request data (IP address, browser user agent, requested address and time) to deliver and protect it.

Abuse protection. To stop the forms being flooded, the server counts submissions per IP address and accepts at most five in ten minutes. On this deployment the count is held only in the server’s memory and disappears within ten minutes or when the server restarts.

Blockchain and security providers. The security tools read public data from blockchain RPC and data providers, Etherscan and GoPlus. Those requests are made by the server and contain only the addresses, network and identifiers needed for the query. No RPC provider is configured on this deployment, so no on-chain request is made.

Visitors receive no cookies, and the website does not use analytics, advertising, session-recording or fingerprinting tools, so there is no cookie banner. Fonts, icons and scripts are served from this website itself; the Content-Security-Policy prevents pages from loading resources from, or sending data to, any other origin.

Staff who sign in to the admin panel or audit workspace receive one strictly necessary session cookie (HttpOnly, Secure, SameSite=Lax). It holds a random token, is removed on sign-out and expires after 12 hours, or after two hours without activity.

If this changes, this policy will be updated first and consent will be requested wherever the law requires it.

• To reply to your inquiry and, if you ask for it, to scope and propose a security engagement.
• To coordinate incident support you request.
• To triage and coordinate vulnerability reports under the responsible disclosure policy, including crediting you if you ask to be credited.
• To protect the website and its forms against spam, abuse and attacks.
• To comply with legal obligations and to establish, exercise or defend legal claims.

Where the data protection law that applies to you requires a legal basis for processing, we rely on:

• taking steps at your request before a possible contract, when you ask about an engagement;
• legitimate interests in answering inquiries, handling vulnerability reports and keeping the website secure, balanced against your rights;
• compliance with legal obligations.

We do not use your information for automated decision-making or profiling, and we do not sell it.

Information is shared only with the service providers that run the parts of the website described here:

Messages delivered by email are also held by the operator’s email provider. Information may be disclosed where the law requires it, or to protect the security of the website, its users or others.

These providers may process information in countries other than the one you live in, including the United States. Where the law that applies to you restricts such transfers, they take place under the providers’ data processing terms and the transfer safeguards those terms provide.

• Encrypted store. Not used on this deployment; submissions are not stored by the website.
• Email. Submissions delivered by email are kept for as long as needed to respond, to handle any resulting engagement or disclosure, and to meet legal obligations, and are then deleted.
• Rate-limit counters. Ten minutes at most.
• Security tool results. Scans, analyses and monitoring records are kept as the platform’s history until the operator deletes them.
• Staff sessions and logs. Sessions end at sign-out or expiry; security logs of staff actions are kept for one year; technical error records for 90 days; provider request statistics (no personal data) for 30 days.
• Hosting logs. According to the hosting platform’s log retention.

The website is served only over HTTPS with HTTP Strict Transport Security. The form endpoint accepts JSON from this website’s own pages, limits request size and frequency, and validates every field on the server. Submissions are delivered only to recipients configured by the operator.

No method of transmission or storage is completely secure. The measures are described in detail on the Trust & Security page.

Depending on where you live, you may have the right to access the information we hold about you, to have it corrected or deleted, to restrict or object to its use, and to receive it in a portable format. To use these rights, contact us as described below. We may need to confirm your identity before acting on a request.

You may also complain to the data protection authority where you live or work.

The website is intended for professionals and is not directed at children. Please do not submit information about children.

This policy changes when the website’s data handling changes. The date at the top shows the current version.

For privacy questions or requests, use the contact form, and mention “privacy” in your message.