Privacy

Netskor keeps as little as it can.

Who is responsible

Netskor is run by Vardis ehf. (in formation), Iceland. Vardis is responsible for the personal data described on this page. If you have a question about it, email netskor@vardis.is.

When you scan a domain

• We store the domain and the results as a report. Anyone with the report's random link can open it. The report stays available for 90 days. After that it can no longer be opened, and we delete it from our database the next time a scan is saved.
• When you start a scan from the form, we store a hash of your IP address, made with a secret key. For IPv6 we hash only the network part of the address. We use the hash for one hour to limit how many scans one connection can start. We delete it the next time anyone starts a scan from the form after that hour, so on a quiet day it can be kept longer. Because we hold the key, the hash is still personal data.
• Database backups let us restore anything we delete, including reports and IP hashes, for 30 days after we delete it.
• We do not store or log your IP address ourselves. Our error logs hold the error and the address of the request, but not your IP address. They are kept for 7 days.

Bot check

The scan form on the front page and the Check now button on reports use Cloudflare Turnstile to tell people from bots. It starts when the page opens, even if you do not scan anything. Cloudflare reads your IP address, your TLS fingerprint and details about your browser. When we check the result with Cloudflare, we do not send your IP address. Cloudflare also uses these signals as a controller of its own, to improve its bot detection. Read more in Cloudflare's Turnstile privacy addendum.

Cookies

Netskor sets no cookies. The language is part of the address: English pages are under `/en/`, and a report link carries `?lang=`. We use no tracking and no analytics.

If your domain is scanned

A scan reads only public data. A report can show public data about people, for example an email address in a DMARC or TLS-RPT record. From registry data we keep only the registrar's name and the expiry date.

During a scan we send the domain name, and nothing about you, to these services:

• Cloudflare and Google, for DNS.
• Cert Spotter and crt.sh, for certificate transparency logs.
• The registry's RDAP service and the registrar's RDAP service when the registry points to it, for registration data. When RDAP is missing or fails, the registry's WHOIS service gets the domain name too. IANA's WHOIS service gets only the top-level domain, to find that server.
• hstspreload.org, for the HSTS preload list. When the domain is not on the list, hstspreload.org connects to its website itself.

We keep public facts about scanned domains, such as a registration's expiry date and its registrar, and the validity dates and issuer of a website's certificate, in Cloudflare's key-value store for up to 30 days, so we do not ask these services again for every scan. They contain no personal data.

To stop scans of your domain, email netskor@vardis.is from an address at the domain. We then block new scans of the domain and hide the reports we have already made.

Emails to us

If you email netskor@vardis.is, we use your name, email address and message to answer you. Our mailbox is at Proton Mail (Proton AG, Switzerland). We keep emails for 12 months. We keep a request to decline or opt out for as long as it applies.

Contacting companies

We never use the reports from scans that visitors start to contact anyone. Vardis also checks the public setup of some Icelandic companies' domains itself and sends the report to the company's general email address, which we find on its website or in public registers. The email says how to decline. We keep the emails we send and any replies for 12 months. If a company declines, we also block its domain.

Who processes data for us

Cloudflare, Inc. hosts Netskor: the servers, the database (stored in the EU) and the bot check. Your IP address passes through its network on every visit. Cloudflare is a US company, so data can be transferred outside the EEA. Cloudflare is certified under the EU-US Data Privacy Framework, which the European Commission has found gives adequate protection. If that certification lapses, the standard contractual clauses in Cloudflare's data processing agreement apply.

Proton AG, in Switzerland, hosts our mailbox. The European Commission has decided that Switzerland protects personal data adequately.

Legal basis

We rely on legitimate interest (Article 6(1)(f) of the GDPR) for each of these purposes. Our interest follows each one:

• running the scanner and making reports available by link: we want to offer a free security check and to find companies that want Vardis's help with the fixes;
• keeping the service safe, with the bot check, the scan limit and error logs: we need to keep out bots and abuse;
• answering your emails: we want to answer the people who write to us;
• contacting companies about their public setup, as described above: we want to offer Vardis's security services.

Your rights

You can ask to see the data we hold about you, have it corrected or deleted, or limit how we use it. Email netskor@vardis.is. We answer within one month.

You can object at any time to our use of your data. Email netskor@vardis.is. We will then stop, unless we have compelling legitimate grounds that outweigh your interests. If we contact your company about its setup, you can tell us to stop at any time, and we will stop.

We cannot link an IP hash to a person without your help. To find yours, we need the IP address you used.

You can also complain to Persónuvernd, the Icelandic Data Protection Authority.

Last updated: 22 October 2026.