Privacy policy

Who we are

TechRS is an Israeli offensive-security company. We provide penetration testing, secure code review and security advisory services, and we operate the website at techrs.co.il (the “site”). This policy explains, as plainly as we can, what personal data the site collects, why, who else handles it, and what rights you have.

TechRS is the controller of the personal data described here. It is written to meet the Israeli Protection of Privacy Law, 5741-1981, including Amendment 13, which has been in force since August 2025, and — for visitors in the European Union or the United Kingdom — the GDPR and the UK GDPR. For any privacy question or request, write to [email protected].

The short version

• We collect what you choose to send us — a pentest request, a newsletter signup, a comment — plus the minimum technical data needed to run and protect the site.
• No analytics, no advertising trackers, no tracking pixels and no third-party cookies.
• We do not sell, rent or trade personal data.
• The only cookies we set are strictly necessary for security and sign-in.
• You can ask to see, correct or delete your data at any time.

What we collect and why

Penetration-testing requests

When you use the “request a pentest” form on our contact page, we collect your full name, work email, company and phone number (both optional), the services you are interested in, your timeline, and your message about the scope. We also record the date and time of the submission and the language version of the site you used.

We use this information to reply to you, scope and price the work, and manage any business relationship that follows. Each submission is stored in our database and emailed to our team’s inbox. The form asks you to confirm that you have read this policy before sending. Under the GDPR, our legal basis is taking steps at your request before entering into a contract, and our legitimate interest in answering business inquiries.

Please do not put credentials, details of unpatched vulnerabilities in your systems, or other sensitive information in the form. Once we are in touch, we will agree on a suitable channel for that.

Abuse-prevention identifier (IP address hash)

When you submit the contact form, confirm a newsletter subscription or post a comment, we store an HMAC-SHA256 hash of your IP address with that record, computed with a dedicated secret key that is kept separate from the site’s other keys. We do not store the IP address itself in these records. We use the hash only to detect abuse, such as repeated spam from the same source, and — for the newsletter — as evidence of when and from where a subscription was confirmed.

This identifier is pseudonymous, not anonymous. The number of possible IP addresses is small enough that anyone holding the secret key could work back to the original address, so access to the key is restricted and we treat the hash as personal data under this policy. Our legal basis is our legitimate interest in protecting the site and its users.

Newsletter

Our newsletter is published in Hebrew. To subscribe we need only your email address. Subscription uses double opt-in: you receive a confirmation link, and nothing else is sent until you click it. We record when you confirmed, together with the IP hash described above, as proof of your consent. Every issue includes a one-click unsubscribe link. Our legal basis is your consent, which you can withdraw at any time by unsubscribing.

User accounts

Public sign-up is closed. Accounts exist for TechRS staff and for readers who registered before sign-up closed, mainly to comment on our Hebrew articles. An account holds an email address, a display name, a password — stored only as a salted hash that we cannot read — and, if you enable two-factor authentication, the authenticator secret and one-time recovery codes. We also keep standard sign-in records such as the time of your last login. We use this data to authenticate you and to attribute your comments.

Comments

Comments on our Hebrew articles are stored with your display name, the time of posting and the IP hash described above. Comments are reviewed before they appear. Once approved, a comment and your display name are visible to everyone who visits the article.

Server logs

Like almost every website, our web server records technical data about each request: IP address, date and time, the page requested, the response status, the referring page and your browser’s user-agent string. We use these logs only for security, troubleshooting and abuse prevention.

Information shared during an engagement

If you become a client, information you share with us as part of a penetration test or advisory engagement — scoping documents, credentials, test accounts, source code, findings and reports — is governed by our engagement agreement and the non-disclosure agreement between us, not by this website policy. Where they differ, those agreements prevail.

Cookies and local storage

We use only cookies that are strictly necessary for the site to work securely. None of them is used for analytics, advertising or tracking.

Cloudflare, which protects the site (see below), may set its own strictly necessary security cookies, such as __cf_bm or cf_clearance, when it needs to tell people apart from automated traffic.

Your theme (light or dark) and accessibility-toolbar preferences are saved in your browser’s localStorage. They never leave your device and are never sent to us. You can clear them with the toolbar’s reset button or through your browser settings.

Who we share data with

We do not sell, rent or trade personal data. We share it only with service providers that process it on our behalf, under their data-processing terms, and only as needed to run the site:

• Cloudflare — content delivery network and security proxy. All traffic to the site passes through Cloudflare, so it processes visitors’ IP addresses and request data in order to deliver pages and block attacks.
• Our email providers — the service that sends the site’s email (newsletter confirmations and issues, account messages and form notifications) and the mailbox where our team receives them.
• Our hosting provider — the server on which the site and its database run.

Apart from these providers, we disclose personal data only where the law requires us to. Some of our providers process data outside Israel, including in the European Union and the United States. Where they do, we rely on the safeguards they offer under the applicable law, such as standard contractual clauses. We do not use personal data for automated decision-making or profiling.

How long we keep data

• Pentest requests: as long as needed to handle your inquiry and any business relationship that follows, and longer only where the law requires (for example, accounting records). You can ask us to delete an inquiry sooner.
• IP address hashes: only as long as the form submission, subscription or comment they belong to.
• Newsletter: while you are subscribed. When you unsubscribe we stop sending immediately and keep only a minimal record (your address and the date you left) so that we respect your choice; ask us and we will delete that too.
• Accounts: while the account is active. Deleting an account also deletes the comments posted from it.
• Server logs: rotated automatically and kept for about 14 days.
• Backups: database backups are kept for 14 days, so data we delete disappears from our backups within that period.

How we protect data

• All traffic to the site is encrypted with HTTPS.
• Passwords are stored only as salted hashes, and accounts support two-factor authentication.
• IP addresses in our records are pseudonymised with a key kept separate from the site’s other secrets.
• Access to the server and the database is restricted and secured.
• The database is backed up regularly.

We are a security company and we welcome scrutiny of our own site. If you find a security issue, please report it under our Responsible Disclosure Policy.

Your rights

Depending on the law that applies to you — the Israeli Protection of Privacy Law and, for visitors in the EU or the UK, the GDPR — you may ask us to:

• access the personal data we hold about you;
• correct data that is inaccurate, incomplete or out of date;
• delete your data;
• object to our processing of your data, including for direct marketing;
• withdraw your consent where we rely on it, for example by unsubscribing from the newsletter.

To exercise any of these rights, email [email protected]. We may need to confirm your identity, for example by asking you to write from the email address the request concerns. We will respond within 30 days.

If you are not satisfied with our response, you have the right to complain to the Israeli Privacy Protection Authority at the Ministry of Justice. Visitors in the EU or the UK may also complain to their local data-protection supervisory authority.

Children

Services that require registration — accounts and comments — are intended for people aged 16 and over. We do not knowingly collect personal data from children under 16; if we learn that we have, we will delete it.

Changes to this policy

We may update this policy from time to time. Any material change will be published on this page, and the “last updated” date at the top will change accordingly.

Contact

Questions about this policy or about your data: [email protected], or through our contact page.