Privacy policy

Last updated: November 6, 2026

1. Who we are

eCloud Systems LLC (“we”, “us”) is a company registered in Florida, United States (contact details in the legal notice). We operate Secupipe, a platform for software supply chain security and compliance (the “Service”), at app.secupipe.com, and the website secupipe.com.

For personal data you give us to run your account — your name, email and billing details — we act as the controller. For the data you and your team put into your company workspace (such as SBOMs, findings, reports, evidence, names of customers and suppliers), your company is the controller and we process it on your behalf as a processor, following your instructions and this policy.

2. Data we collect

• Account data: your name, work email and company name. Sign-in and passwords are handled by our authentication provider WorkOS; we do not store passwords ourselves.
• Workspace content: products, systems, SBOMs and their components, vulnerabilities and VEX assessments, reports, evidence, policies, team invitations and the log of all changes.
• Billing data: booked modules, number of users, billing address and payment history. Card details are handled by our payment provider; we never see or store full card numbers.
• Usage and device data: log data such as IP address, browser type, pages visited and timestamps, used to keep the Service secure and working.
• Communications: messages you send us and our replies.
• Cookies: strictly necessary cookies to keep you signed in, and — only if you accept them — Google Analytics and Meta Pixel cookies on secupipe.com (see section 9).

3. How we use data and why

• To provide the Service — set up your workspace, read and match SBOMs, track deadlines and reports, generate evidence (performance of our contract with you).
• To bill your subscription and keep financial records (contract and legal obligation).
• To secure the Service, prevent abuse and fix errors (legitimate interests).
• To run the AI assistant when you use it — preparing assessment suggestions and drafts (performance of our contract). We do not use your content to train AI models.
• To improve the Service using aggregated usage information (legitimate interests).
• To measure reach and ads on secupipe.com, only with your consent.
• To comply with law and enforce our rights (legal obligation and legitimate interests).

We do not sell personal data, and we do not use your workspace content for advertising.

4. Who we share data with

We share personal data only as needed to run the Service:

• Hetzner Online GmbH (Germany) runs our servers. The Service and its database run in data centers in Germany.
• WorkOS, Inc. (USA) handles sign-in, sign-up and single sign-on.
• Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments and invoices.
• Google (Google Ireland Limited / Google LLC) and Meta (Meta Platforms Ireland Ltd / Meta Platforms, Inc.) receive data only if you consent on secupipe.com (section 9).
• Professional advisers such as auditors and lawyers, under confidentiality obligations.
• Authorities, where required by applicable law.
• A buyer or successor, if our business is reorganised, merged or sold — in which case this policy will continue to protect your data.

To match vulnerabilities, we send package identifiers (package URL with name and version) of your components to the public OSV database (Google LLC) and CVE identifiers to FIRST (EPSS). No personal data is included. A current list of sub-processors is available on request.

5. International transfers

We and our providers process some data outside the EU, for example in the United States. We rely on the safeguards required by law, such as adequacy decisions or EU standard contractual clauses.

6. How long we keep data

We keep account and workspace data for as long as your account is active. The change log is immutable and forms part of your workspace evidence. After you cancel, we delete or anonymise workspace content within 90 days, unless you ask us to delete it sooner. Billing records are kept for as long as tax and accounting law requires. Server logs are kept only as long as needed for operations and security. Backups are overwritten on a rolling schedule.

7. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, strict separation of company workspaces, access controls and logging. No system is completely secure, but we will notify you without undue delay if a breach affects your data.

8. Your rights

Depending on where you live — including under the EU/UK GDPR and other applicable data protection laws — you may have the right to access, correct or delete your data, restrict or object to processing, and receive your data in a portable format. You can withdraw consent at any time, and you may lodge a complaint with your data protection authority.

To exercise a right, email mail@secupipe.com. If your request concerns data a customer of ours has put into their workspace, we will pass it to that customer.

9. Cookies and local storage

Strictly necessary and always on: your sign-in session in the app, your cookie choice (cookie sp_consent, one year), and language, theme and last selected company in your browser’s local storage.

Only with your consent on secupipe.com: Google Analytics, loaded via Google Tag Manager, to understand how visitors use the website, and the Meta Pixel, to measure our ads on Facebook and Instagram. Both set cookies and send visit and sign-up events to Google and Meta. The scripts are only loaded after you click Accept in the cookie banner; until then nothing is sent. We keep analytics data for no longer than 14 months.

You can change or withdraw your choice at any time under Cookie settings in the footer. Withdrawing consent stops further data from being sent; you can also delete existing cookies in your browser settings.

10. Children

The Service is built for businesses and is not directed at children under 16. We do not knowingly collect their personal data.

11. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new date and, for material changes, notify administrators by email before they take effect.

12. Contact

Questions about this policy or your data: mail@secupipe.com — eCloud Systems LLC, Sarasota, Florida, USA.