Privacy Policy

Direct Users

Individuals employed by or acting on behalf of the organization that owns the AWS account being assessed.

Third-Party Users (e.g., Audit Firms)

Professionals who use BlackBox Auditor on behalf of clients, connecting to AWS accounts owned by a third party.

If you are an audit firm or external professional using this tool on a client's AWS environment, you are responsible for ensuring you have obtained appropriate written authorization from that client before initiating any connection or scan. AWS environment metadata processed through the platform in this context is handled on your behalf, and you remain the data controller for that engagement. We recommend maintaining your own data processing agreements with your clients as required by applicable law.

Account Information

When you register, we collect your name, email address, and billing information. Billing transactions are processed by PayPal and/or Stripe — we do not store raw payment card details.

AWS Connection Credentials

To initiate a connection, you provide an IAM Role ARN and External ID. These are used transiently to establish the cross-account session and are not stored in our systems. We retain no record of your IAM Role ARN, External ID, or AWS Account ID after the connection is made.

AWS Environment Metadata

To generate audit reports, we ingest configuration metadata from your AWS environment — for example, IAM policies and resource configuration settings. We do not access, read, or store application data, database contents, secrets, or credential values.

Website Analytics

Blackboxauditor.com uses Google Analytics to collect standard website usage data such as pages visited, browser type, and approximate location. Google Analytics may set cookies in your browser. You can opt out using the Google Analytics Opt-out Browser Add-on.

Service Usage Analytics

We operate an internal analytics system hosted on AWS infrastructure to track report generation and usage activity within the platform. This data is used solely for service improvement, capacity planning, and security monitoring. It is not shared with third parties and is subject to the same 14-day retention period described below.

• PayPal and/or Stripe — billing and subscription management
• Zoho — account and transactional email communications
• Google — website analytics (blackboxauditor.com)

These providers are contractually bound to process data solely on our instructions and in accordance with applicable law.

We do not sell, rent, or share your personal data with third parties for their own marketing or commercial purposes.

For Users in the European Economic Area (GDPR)

We process your personal data on the basis of contract performance (account information and service delivery) and legitimate interests (security and platform integrity). You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request erasure of your data ("right to be forgotten")
• Restrict or object to processing of your data
• Receive your data in a portable format
• Lodge a complaint with your national data protection supervisory authority

For California Residents (CCPA)

You have the right to know what personal information we collect and how it is used, to request deletion of your data, and to opt out of the sale of your personal information.

We do not sell personal information.