Privacy, DPA and deletion

Last updated 27 October 2026. This page describes exactly what the free restore-age scan does with your AWS metadata. It is written to be read by an engineer, not by a lawyer.

1. What we read

Metadata only, through a read-only IAM role that you create and can delete at any time: resource identifiers, backup retention, snapshot dates, S3 versioning/replication/lifecycle configuration, AWS Backup plans and restore-job history.

We never read the contents of a backup: no S3 object, no database row, no snapshot data, no logs, no CloudTrail events. The role has no permission to do so (s3:GetObject, s3:ListBucket and cloudtrail:LookupEvents are not granted).

2. What we store

• The report itself: account id, account label if you typed one, region list, and the per-resource metadata listed above.
• A salted SHA-256 hash of your IP address, used only to rate-limit abuse.
• Creation and expiry timestamps.

We do not store your role ARN, your ExternalId or any AWS credential. The STS session lives in memory for the duration of one scan (15 minutes maximum) and is discarded afterwards. Re-running a scan requires you to submit the role ARN again.

3. Retention and deletion

Reports are kept for 30 days and then deleted automatically. Every report page has a “Delete this scan now” button that removes it immediately, including its IP hash. You can also email hello@dglabs.cloud and we will delete it within one business day.

Revoking our access is independent of us: delete the CloudFormation stack in your account and the role — and with it every permission — is gone.

4. Roles under GDPR / Australian Privacy Act

For a free scan, we act as a processor of the infrastructure metadata you point us at. We do not sell it, do not use it to train models, and do not share it with third parties. The only sub-processor is the EU-hosted VPS provider that runs this service (compute and encrypted storage). AWS itself is not a sub-processor: your metadata is read by our process, not copied to a third-party service.

A Data Processing Agreement (EU SCCs where applicable) is available on request before any paid plan: hello@dglabs.cloud. We will send it as a signed PDF, not a click-through.

5. Security measures

• Cross-account access only through sts:AssumeRole with a mandatory ExternalId and 15-minute sessions.
• TLS in transit; encrypted volume at rest for the report database.
• No secrets in the repository; configuration through environment variables.
• Least-privilege policy published as a CloudFormation template you can diff before deploying.

6. What we do not claim

This is not a compliance certification, not a penetration test and not a guarantee that your backups will restore. We report dated facts about restores we can observe. Whether your auditor or insurer accepts that evidence is their call, and we say so on every report.

Questions, DPA requests or deletion: hello@dglabs.cloud · back to the scan