SecureChain by TuxCare
Privacy notice
Updated 7 November 2026.
Who we are
SecureChain by TuxCare finds the vulnerable dependencies of your software projects. TuxCare Inc., registered at 20791 Three Oaks Pkwy, #980, Estero, FL 33929, USA, operates it. TuxCare Inc. is the controller of the personal data that this notice describes.
This notice covers the hosted service of SecureChain: this site (sc.tuxcare-staging.work), the workspaces (name.sc.tuxcare-staging.work), and the TuxCare sign-in service (auth.tuxcare-staging.work). It supplements the SecureChain Portal Privacy Policy. The cookie notice lists the cookies and the browser storage of the hosted service.
Data we receive when you sign in
You sign in to SecureChain through the TuxCare sign-in service. It sends you to the sign-in provider that you select, for example Google, GitHub, or Microsoft. You sign in at the provider. The provider then tells the sign-in service who you are. We never see the password of your account at the provider.
Sign in with Google
When you sign in with Google, we receive this data from Google:
- Your email address.
- Whether Google has verified your email address.
- Your Google account ID: a number that identifies your Google account.
- For a Google Workspace account, the domain of the Google Workspace of your organization.
- Your name and the address of your profile picture.
The sign-in service uses your email address, the verification of the address, your Google account ID, and the Workspace domain. It discards your name and your profile picture: it does not keep them, and it does not pass them on to this site or to a workspace.
We do not get access to your Gmail, Google Drive, contacts, calendar, or any other data of your Google account. We do not keep the access token that Google gives the sign-in service. We do not call Google for you after you sign in.
Sign in with GitHub
When you sign in with GitHub, you let SecureChain read your GitHub profile and the email addresses of your GitHub account (the GitHub scopes read:user and user:email). We receive this data from GitHub:
- Your GitHub profile: your GitHub account ID (a number that identifies your GitHub account), your username, your name, the address of your profile picture, the public email address of your profile, and the other fields of your profile.
- The email addresses of your GitHub account, and for each address, whether it is your primary address and whether GitHub has verified it.
The sign-in service uses your GitHub account ID, your primary email address, and whether GitHub has verified that address. If GitHub names no primary address, the sign-in service uses the public email address of your profile and treats it as not verified. It discards your username, your name, your profile picture, your other email addresses, and the other fields of your profile: it does not keep them, and it does not pass them on to this site or to a workspace.
We do not ask for access to your repositories, your code, or your organizations, and we do not read them or any other data of your GitHub account. We do not keep the access token that GitHub gives the sign-in service: the sign-in service uses it to read your profile and your email addresses while you sign in, and then discards it. We do not call GitHub for you after you sign in.
Sign in with Microsoft
You can sign in with a work or school account of any organization, or with a personal Microsoft account. When you sign in with Microsoft, you let SecureChain sign you in and read your basic profile and your email address (the Microsoft scopes openid, email, and profile). We receive this data from Microsoft:
- Your email address, if your Microsoft account has one.
- Whether Microsoft has verified the owner of the domain of your email address.
- Your object ID (an ID that identifies your account in its directory) and your tenant ID (an ID of the directory of your organization; all personal Microsoft accounts share one tenant ID).
- Your name and your username (the email address, phone number, or other name that you sign in with).
- Technical data of the sign-in, for example an ID of your account that Microsoft makes for SecureChain only, the time of the sign-in, and an ID of your session.
The sign-in service uses your object ID and your tenant ID, your email address, and whether Microsoft has verified the owner of the domain of that address. If Microsoft does not say that the domain is verified, the sign-in service treats the address as not verified. It discards your name, your username, and the other data that Microsoft sends: it does not keep them, and it does not pass them on to this site or to a workspace.
We do not ask for access to Microsoft Graph, your mail, your files, your contacts, your calendar, or any other data of your Microsoft account, and we do not read them. We do not use or keep the access token that Microsoft gives the sign-in service. We do not call Microsoft for you after you sign in.
Other data we keep
- When you create a workspace, we record its name, your account ID and email address as its owner, the time, and the network address that the request came from. For an IPv6 address, we keep the first half (the /64 network) only.
- When you sign in to the SecureChain command-line tool in your browser, we record your email address, your account ID, the network address of the tool, and the device name and version that the tool reports.
- A workspace keeps a user record for each member: the email address, the account ID at the sign-in provider, the role, the time of the last sign-in, and the time when the member accepted the terms. Its audit log records the actions of its members, with the email address and the network address of each person.
- A workspace keeps a record of each acceptance of the SecureChain Portal agreements: the email address and the account ID of the person, the legal name of the organization, the version of each document, the time, the network address, and whether the acceptance came from the signup, the web app, or the sign-in of the command-line tool. We keep this record for legal and audit purposes and to establish, exercise, or defend legal claims.
- A workspace also keeps the data that its members and their tools send to it, for example the package lists of scans and the addresses of repositories. The admins of the workspace control that data.
How we use the data
We use the data for these purposes only:
- To sign you in and keep you signed in.
- To identify your account, and to show the workspaces that you own or are a member of.
- To add you to a workspace that invites your email address. For this, the sign-in provider must have verified your email address.
- To add you to a workspace that admits the people of your Google Workspace domain. This works with Sign in with Google only. For this, Google must have verified your email address, and the workspace must list the domain.
- To send you the email of your workspaces, for example an invitation or an alert that you or an admin turned on.
- To protect the service, for example to limit the number of workspaces that one person or one network address can create, and to keep the audit log of a workspace.
We do not use the data for advertising. We do not sell it.
Legal bases
Under the GDPR and the UK GDPR, we rely on these legal bases:
- Contract. To sign you in, to give you your workspaces, and to send the email of your workspaces. We need the data to provide the service that you asked for.
- Legitimate interests. To protect the security and the integrity of the service: the limits on new workspaces, the audit log, and the read-only view that TuxCare staff use to give support.
- Legal obligation. When the law requires us to keep or to disclose data.
Where we keep the data and for how long
| Where | What | How long |
|---|---|---|
| The sign-in service | The data that the provider sends (see above), while you sign in and for the short-lived access token that this site or a workspace receives. | 10 minutes for a sign-in; 1 hour for an access token. Then we delete it. |
| Your browser | The sign-in session of this site and of each workspace, in cookies (see the cookie notice). | The cookie notice gives the duration of each cookie. |
| The directory of workspaces | The owner, the creation record, and the network address of each workspace. | As long as the workspace exists. After a delete, the record stays, so that no new workspace can take the same name. |
| Command-line sign-in | The record of a sign-in of the command-line tool. | One day after the sign-in request expires |
| Your workspace | The user records, the audit log, and the data of the workspace. | As long as the workspace exists. After a delete, 30 days. |
| The acceptance record | The record of each acceptance of the SecureChain Portal agreements in a workspace. | As long as the workspace exists, also after an admin removes the person from the workspace. After a delete, 7 years. |
| Backups and service logs | Copies of the databases, and the logs of the servers. | While we have a legitimate business need for them. Then we delete or anonymize them. |
The servers and the databases of the hosted service are in a data center in Germany (Falkenstein). TuxCare Inc. is in the United States, and some service providers work from outside the EEA and the UK. For such a transfer, TuxCare uses the Standard Contractual Clauses and the UK International Data Transfer Addendum. TuxCare Inc. also complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework. The SecureChain Portal Privacy Policy describes these safeguards.
Who we share the data with
We do not share your personal data with other companies for their own use. These people and companies can see it:
- The people with the member or admin role in a workspace see the email addresses of its other users. The admins of a workspace also see its audit log.
- TuxCare staff can open a read-only view of a workspace to give support.
- Service providers that run the service for us, under a contract:
- Hetzner Online GmbH (Germany): the servers, the databases, and the backups.
- Cloudflare, Inc. (United States): the DNS of the service, and Cloudflare Email Service, which sends the email of the workspaces.
- A public authority, when the law requires it.
Annex 3 of the SecureChain Portal Data Processing Addendum lists the subprocessors, TuxCare tells the owner and the admins of each workspace by email at least 30 days before a new or replaced subprocessor starts, and a customer can object within 30 days at privacy@tuxcare.com.
You sign in at the sign-in provider that you select, so the provider knows that you use SecureChain. The provider is not our service provider: it handles the data of your account under its own privacy policy.
- Google LLC (United States): the Google Privacy Policy.
- GitHub, Inc. (United States): the GitHub General Privacy Statement.
- Microsoft Corporation (United States): the Microsoft Privacy Statement.
Your choices
- Delete a workspace. The owner of a workspace can delete it on Manage workspaces. The workspace stops at once. Its data is kept for 30 days, then removed.
- Leave a workspace. An admin of the workspace can disable your access on its Users page.
- Remove the access of SecureChain to your Google account. Open the third-party connections of your Google account and remove SecureChain. The next time that you sign in with Google, Google asks for your consent again. This does not delete the data that we keep. To delete it, contact us.
- Remove the access of SecureChain to your GitHub account. Open the Authorized OAuth Apps of your GitHub settings (Settings, Applications, Authorized OAuth Apps) and revoke SecureChain. The next time that you sign in with GitHub, GitHub asks for your consent again. This does not delete the data that we keep. To delete it, contact us.
- Remove the access of SecureChain to your Microsoft account. For a personal Microsoft account, open the apps and services that can access your Microsoft account and remove the permissions of SecureChain. For a work or school account, open My Apps, select Manage your application for SecureChain, and revoke its permissions. Your organization may control this: if an administrator consented for your organization, you cannot revoke the permissions yourself, so ask the administrator. Unless an administrator consented for you, Microsoft asks for your consent again the next time that you sign in with Microsoft. This does not delete the data that we keep. To delete it, contact us.
- Use your rights. Under the GDPR and the UK GDPR, you can ask for access to your personal data, and ask us to correct it, to delete it, to restrict its processing, or to give it to you in a portable form. You can also object to a processing that relies on our legitimate interests. To use a right, write to privacy@tuxcare.com. We may first verify your identity. The SecureChain Portal Privacy Policy describes each right, and the rights of California residents.
Contact
To ask a question about this notice or to use your rights, write to privacy@tuxcare.com. This address also reaches the Data Protection Officer of TuxCare.
The representative of TuxCare in the EU is IT.LAW GmbH, Colmantstraße 15, 53115 Bonn, Germany (art-27-rep-tuxcare@it.law). The representative of TuxCare in the UK is Rickert Services Ltd UK, PO Box 1487, Peterborough PE1 9XX, United Kingdom (art-27-rep-tuxcare@rickert-services.uk).
Children
SecureChain is not intended for people under 16. We do not knowingly collect personal data of children under 16.
Changes to this notice
When we change the data that we receive or how we use it, we update this notice and its date.