Privacy Policy
This policy explains what personal data Fortress collects, why, and what you can do about it. Fortress is a product of Miantech (“Miantech”, “we”, “us”), based in the United Kingdom. You can reach us at admin@miantech.co.uk.
1. Two kinds of data
- Your account data is what you give us to have a Fortress account. For this, we are the data controller.
- Data your own application sends to Fortress through the API or SDK can include information about your end users, for example an IP address attached to an unusual traffic pattern. For this, you are the controller and we act as your processor: we handle it only to provide the service to you.
2. Account data we collect
- Account: your email address and a hashed password (never the password itself), plus when the account was created and verified.
- Sign in with Google: if you choose it, Google tells us your email address and whether Google has verified it. We do not receive your Google password and we do not access any other Google data.
- Usage: the projects, environments and API keys you create, sign-in times, and an audit log of important actions on your account (such as password changes).
- Security: sign-in attempt patterns, including IP addresses, used only to detect and slow down password-guessing attacks.
- Free website check and demo: the address you type into the website check is read once and the result is kept in memory for ten minutes. We log that a check happened (the site address and the grade) in our operational log. If you ask for your report or a setup guide by email, we store your email address, the site address, which page you used, when you agreed, and an unsubscribe code. We use it only to send what you asked for and occasional product updates. You can unsubscribe in one click from any email, or ask us to delete it at admin@miantech.co.uk.
- Billing: Fortress is currently free. If paid plans are introduced, payment details will be handled by our payment provider and we will not see or store full card numbers.
3. Data your application sends us
If you connect an app, it sends events and telemetry such as error rates, dependency health and traffic patterns. Our detectors use these to spot incidents and power the dashboard. This can include an IP address if your integration passes one along. You decide what your integration sends, and you are responsible for having a lawful basis to send it.
We do not sell this data, use it to train models for anyone else, or share it with anyone except the providers listed below.
4. How we use data
- To provide, maintain and secure the service: detection, incidents, dashboards and account management.
- To send service emails: confirming your address, welcoming you, and resetting your password. We do not send marketing email without your separate agreement.
- To detect and prevent abuse of the service.
- To meet legal obligations.
Our lawful bases under UK GDPR are performing our contract with you, our legitimate interest in keeping the service secure, and legal obligation.
5. Who else handles your data
| Provider | Purpose | Data involved |
|---|---|---|
| Google Cloud | Hosts the servers Fortress runs on (London region) | All data described above, at rest and in transit |
| Google (Sign in with Google) | Optional sign-in | Your email address and its verification status |
| Resend | Sends service emails | Your email address and the message content |
| Stripe | Payments, only if paid plans are introduced | Payment and billing details |
Fortress’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
6. How we protect it
- Passwords are hashed with scrypt and a unique salt. They are never stored or logged in plain text.
- All traffic to Fortress is encrypted with HTTPS.
- Access needs a signed session token, and resetting a password signs out every other session.
- Each customer’s data is kept separate from every other customer’s.
- An append-only audit log records security-relevant actions.
No system is perfectly secure, so we cannot promise absolute security. We do commit to telling you promptly if a breach affects your data.
7. How long we keep data
- Raw telemetry: 30 days.
- General operational events: 90 days.
- Resolved security events: 180 days. Unresolved ones are never deleted automatically.
- Resolved incidents and protection history: 365 days. Unresolved ones are never deleted automatically.
- Audit log: kept so we can always answer “what happened on this account”.
- Email requests from the website check and demo: until you unsubscribe or ask us to delete them.
- Server backups: kept for up to 14 days.
8. Your rights
- Access and export: download all your account data as JSON from the Account tab at any time.
- Deletion: permanently delete your account from the Account tab. This erases your projects and their data and cannot be undone.
- Correction: change your password in the dashboard, or email us to correct anything else.
- Under UK GDPR you can also ask us to restrict or stop processing, or to move your data. Email us and we will reply within one month.
- If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk.
9. Where data is processed
Fortress is hosted in London. Some providers, such as our email provider, may process data outside the UK. We only use providers that offer recognised safeguards for those transfers.
10. Children
Fortress is not aimed at anyone under 18, and we do not knowingly collect their data.
11. Changes
If we make a material change to this policy we will tell you by email or in the dashboard before it takes effect.
12. Contact
Questions or requests about your data: admin@miantech.co.uk.