Privacy Policy
Last updated: 2026-08-20. This page describes the intended production privacy boundary for Morrow pilots and deployments.
What We Collect
- Account data: name, email address, organization, role, and authentication metadata.
- Cryptographic evidence: approved targets, TLS metadata, certificate metadata, algorithm families, CBOM fingerprints, firmware hashes, runtime handshake proofs, policy results, and remediation state.
- Operational data: API logs, audit events, security events, support records, and usage metrics needed to operate and secure the service.
Data We Do Not Collect By Default
Morrow is designed not to collect source code, private keys, secrets, tokens, raw packet payloads, customer production records, or broad filesystem images by default. Quantum Airlock redacts and fingerprints sensitive evidence before submission.
How We Use Data
We use data to provide cryptographic discovery, post-quantum readiness analysis, remediation workflow, Trust Passport output, compliance ledger reporting, support, abuse prevention, and service security. We do not sell customer data and do not use customer scan data for advertising.
Sharing And Retention
Data is shared only with subprocessors needed to run the service, comply with valid legal process, protect the service, or as directed by the customer.
The new authentication journal defaults to 90 days (configurable 1-365); retained API request metadata defaults to 7 days (configurable 1-30). Expired records are excluded from views immediately and removed in periodic batches while the service runs. Backup, SIEM, historical action-audit, scan/evidence and support retention must be separately configured and agreed with the customer; these journal limits do not automatically delete those copies.
Depending on location, users may have rights to access, correct, export, delete, restrict, or object to processing of personal data.
The Free Public Checker
This policy covers accounts and the paid product. The free, no-account readiness check at /check is different in kind: it has two subjects rather than one, because a visitor with no account can cause a connection to a host they may not own. It therefore has its own notice, covering what is recorded about the person asking and what is recorded and published about the party being checked.
Read the privacy notice for the free checker, and the abuse and opt-out page if you operate a domain and do not want it checked. The scanner identity page identifies the traffic for an operator who found it in their logs.
Contact
Privacy requests: customers can raise them through Feedback in the console or with their named account contact, who will route them to the privacy owner. If you are not yet a customer, contact us through the pilot request page.