Privacy notice

1. What this notice covers

This notice applies to the Detections service at sunturai.com: the public catalogue, the workspace that comes with an account, and the mail the service sends you. Throughout, “the service” means that and nothing wider.

It does not apply to the public repositories the catalogue draws from. Those are run by other projects, under their own terms, and reading a rule here is not the same act as visiting the project it came from. It does not apply to any other site you reach by following a link out of this one.

The three sections that follow describe what is collected, split by where it comes from: what you give the service, what the service records because you used it, and what reaches it from public sources without anyone having signed up.

2. Information you provide

Your account. The name you chose, the email address you signed up with, whether that address has been confirmed, an optional picture, and the dates the record was created and last changed. Your display name is shown wherever your work appears; your address is not.

Your credentials. Detections runs its own identity provider rather than delegating to an external one, so your password and any tokens from a social sign-in are held in this system rather than with a third party. Passwords are not stored in plaintext: what is stored is a hash used to verify a sign-in. If you add a second factor, the information needed to verify it and the recovery material that goes with it are stored protected, together with a count of failed attempts so the factor can be locked after repeated failures.

Your workspace. Detection content you write is private to your workspace until you share or contribute it. Every save creates a version, so the history of a rule is kept rather than overwritten — including drafts and versions you never published, which remain part of the workspace's history for as long as the workspace does.

What you contribute. When you contribute a rule to the public catalogue, the licence you chose, the attribution you asked for and your confirmation that you were entitled to contribute it are recorded with it. What that means for ownership is on content and licensing.

3. Information collected as you use it

Sessions. A session records when it was opened, when it was last renewed, when it expires, and whether it ever presented a second factor. You can see every session your account has open and end any of them from your profile, and changing your password ends all the others at once. Detections does not derive a device fingerprint or a location history from account sessions, which is why the sessions screen shows you times and assurance rather than a city and a browser.

Security and abuse-prevention records. Signing in, signing out, requesting a confirmation or recovery mail, changing a password and answering a second-factor challenge are each recorded as an event, as are actions that change something inside the product. An event carries what happened, the account it concerns, the outcome, and when. These records are designed not to contain passwords, authentication tokens, API keys or credentials for external services.

Two kinds of record are kept and they differ in one respect worth stating. Authentication records carry no network address at all, and the field is left empty deliberately: the address the service observes identifies the network path a request travelled rather than the person who made it, and recording it as though it identified somebody would be worse than recording nothing. Records of actions taken inside the product can carry the address the request arrived from. Where an address is used to count repeated sign-in attempts, it is hashed before it leaves the process that received it.

Where you came from. If you reach the sign-up page through a shared link, the campaign parameters on that address — the platform, the channel and the campaign name — are read from it so we could tell which links bring people here. Alongside them, one record may keep the kind of public page you set out from — the front page, the catalogue, a rule, an ATT&CK entry, a contributor page or one of these documents — and, where that page was a rule or an ATT&CK entry, the public identifier that page already shows in its own address. Nothing else: no title, no search you typed, no contributor’s name, no page of your own.

It is written once, when the account is made, and never updated afterwards — a single line about where you set out from, not a record of what you read on the way. An account made without any of it is simply unattributed, which is the ordinary case for anyone who typed the address or returned to it later.

The same few values are also kept on the account record, because that is what carries them from the sign-up screen to where they are recorded. It is the same handful of values and not a second, richer copy, nothing adds to it later, and it is removed when the account is. Said here rather than left to be discovered, because the attribution record is swept after two years and this is not.

Either way, nothing else from that link is recorded against the account: not the network address it arrived from, not the page before it, not your browser or device. Nothing about this is stored in your browser — no cookie, and nothing kept in browser storage between visits. It travels in the address you arrived on and leaves the visible address as soon as it has been read. No browser or measurement identifier is kept with it; the record belongs to the account itself, which is also why deleting the account deletes it.

This record rests on our legitimate interest in knowing which public pages lead people to create an account, rather than on the analytics choice above — you can object to it, and to any other use we base on that interest, by writing to the address at the end of this page.

Measurement of the public pages. Detections measures how its public pages are used — which rules and techniques people look for, which searches return nothing, which pages are slow. This section describes that measurement as it runs, and it was published here before the measurement began rather than after.

It runs on the public pages and on the sign-in and sign-up pages, and never inside the product or the administrative screens. It runs only for people who choose it: one optional choice, asked once, changeable at any time from the footer or from your profile. Declining loads nothing and sends nothing — not a reduced measurement, none.

For somebody who chooses it, a cookie distinguishes one browser from another. It is set to last 180 days from the moment it is set, and it is not renewed by visiting again, so it expires on the same schedule as the choice that allowed it. The plain consequence, stated rather than implied: within that window the same browser can be recognised between visits. What the measurement itself carries is as specific: no account identifier, no email address, and not your network address — it is relayed by this site rather than sent from your browser to the measurement service, and this site does not pass your address on. Two things that relay does not cover, said here rather than left to be discovered. The browser's own description of itself travels with the measurement, because a breakdown by browser means nothing without it. And your browser fetches the measurement programme from the measurement service directly, which shows that service your address the same way asking any site for any file does — the relay covers what is measured, not the download of the thing that measures. That browser identifier is not linked to an account, and nobody is followed between devices.

Which page brought you to sign-up. When you reach the sign-up page from a public page — a rule, a technique, the catalogue, the home page — the sign-up carries the name of the kind of page you came from and, when that page is public content, its public reference. It is a closed list of names: never a search term, never the address you were on, never anything about a private rule or workspace, never a shared link. It is not kept in your browser: it travels once, with the sign-up, and is removed from the address bar before the page is measured. Nothing records it today, for the same reason as the campaign parameters above. Should that change, it changes on this page first.

4. Information that arrives from public sources

This is the one category that concerns people who never created an account. Detection content in the catalogue comes from public repositories, and most of it carries the name its author signed it with. That name is published beside the rule where the licence covering the material calls for attribution. A rule whose document carries no signature is shown without an author rather than credited to whoever hosts the repository — Detections does not guess one, and does not merge two people because their names match.

Where a document signs with an address rather than a name alone, that address is stored with the record. It is never published: the projection the public pages read carries the display name and the organisation and does not carry the address.

If a name here is yours, write to contacto@sunturai.com and how it appears can be corrected, or the page that gathers your work withdrawn — that page is kept out of search engines for this reason. What can and cannot be changed about an attribution, and why the answer depends on the licence rather than on a rule of ours, is on content and licensing.

5. How this information is used

• Operating your account and the workspace that comes with it.
• Verifying a sign-in, and a second factor if you added one.
• Sending the transactional mail that confirms an address or recovers a password.
• Keeping the service secure, rate-limiting abuse of it, and investigating a security incident if one happens.
• Publishing the catalogue with the provenance and attribution each rule arrived with.
• Understanding which shared links bring people here.

6. What it is not used for

Detections does not use account information for behavioural advertising, does not sell it, and does not track you across other sites. There is no tracking pixel. The pages this site serves refuse to run any script this application did not load itself, so a tag injected into a page cannot execute — but the measurement programme is one this application does load, and it is fetched from the measurement service rather than served from here.

An analytics cookie does exist, for the people who chose it and for as long as the section above describes — this page said so before it did, which is the order this notice keeps. What does not change either way: no behavioural advertising, no sale of your information, and no tracking of you across other sites.

Two things are worth separating rather than collapsing into a single promise. What Detections does not do, with or without that measurement, is build an advertising profile: advertising signals and ad personalisation are switched off, and the parameter names that would carry an account identifier are refused rather than merely left unset, so nothing collected is joined to an account or followed across devices. Its infrastructure providers do process the network and request metadata necessary to deliver and secure the service, in the ordinary way that serving a website requires.

No credentials for your own detection tooling ever reach this system. Detections reads rules from public repositories and works on the text you give it; it does not connect to your SIEM and has nowhere to put a credential for one.

7. How information is shared

Detections does not sell personal information, and does not hand it to anyone to use for their own purposes. It is shared in three circumstances and no others:

• With the providers that run the service — a content delivery and network security provider, through which every request to this site passes; a managed database host, which holds account and identity data; a compute host, which runs the application; and a transactional email provider, which delivers confirmation and recovery messages and therefore handles the address and contents of those. Each processes only what its own part requires, and none of them receives your information to use for purposes of its own.
• What you publish yourself — a rule you contribute to the public catalogue appears with the attribution you chose, which is the point of contributing it. Nothing in your workspace becomes public without that explicit act.
• Where the law requires it — a valid legal obligation is not something this notice can contract out of, and saying otherwise would be a promise nobody can keep.

8. Where it is processed

Every one of those providers is established in the United States, so the information necessary to operate the service is processed there rather than where you are. Detections does not currently offer a choice of processing region, and does not claim one.

9. How long it is kept

How long each kind of record is kept, rather than a single number that would be wrong for most of them:

Account profile

While the account exists, then as described below.

Sessions

Until they expire or you revoke them.

Second-factor material

Until the factor is removed or the account is deleted.

Security and audit evidence

Three years as currently configured. It is an operational setting an administrator can move between one and ten years, and shortening it destroys evidence on the next housekeeping pass.

Signup attribution

At most two years, and deleted with the account before that if you delete it sooner. It may hold the campaign parameters on the link you arrived through, the kind of public page you started the sign-up from, and — where that page was a rule or an ATT&CK entry — that item’s public identifier. The same few values are also held on the account record itself, which is what carries them there; that copy has no two-year sweep and goes when the account goes.

Analytics choice

180 days, then you are asked again.

Measurement records

14 months. The analytics cookie expires 180 days after it is set and is not renewed by visiting, so the identifier and the choice that allowed it end together.

Workspace content

For as long as the workspace exists.

Published contributions

Under the licence they were published beneath, which is a question about the content rather than about your account.

10. Deleting your account

You can schedule deletion from your profile. It does not happen immediately: there is a grace period during which nothing has been destroyed and you can cancel. When it executes, your sessions, your second factor and its backup codes, and your stored credentials are deleted outright.

The account record itself is not removed. Its address is replaced with one that cannot receive mail and its display name is emptied, which is de-identification rather than anonymisation — the record keeps its identifier, because the append-only security evidence above refers to it and removing the row would leave those records pointing at nothing. Calling that anonymisation would claim an irreversibility it does not have. Detection content you already contributed to the public catalogue stays published under the licence it was contributed under.

11. Keeping it secure

The controls this service is built with — the trust boundaries between its planes, the isolation between workspaces, and the audit evidence that mutating operations leave behind — are described on security, along with how to report a vulnerability. Those are architectural properties rather than a certification, and no set of them makes a service impossible to breach; the honest statement is what is in place, which is why it is written down where it can be checked.

12. Your rights and choices

Most of what you might want, you can do yourself: reviewing and ending sessions, changing your password, adding or removing a second factor, and scheduling deletion are all in your profile. For the rest — asking what is held about you, asking for it in a portable form, asking for a correction — write to us and a person will answer. There is no self-service export today, and this page does not pretend otherwise.

Two limits are worth stating plainly rather than discovering later. Security evidence is append-only, so a record that a sign-in happened is not removed on request; it is what makes the trail worth keeping, and it is de-identified with the account rather than erased. And an attribution that the licence covering the material requires is not removed on request either — what can change is how the name appears and whether the page collecting your work exists.

A third applies only if you choose the measurement described above. Withdrawing that choice stops any further collection and clears the analytics cookie from your browser. It does not retroactively delete what was already collected — and because no account identifier is sent with that measurement, those records cannot be located as yours. There is nothing in them that points back to you, which is the point of collecting them that way and also the reason they cannot be picked out for an individual deletion. That is a consequence of not identifying you, not an exception to your rights over the information that is yours.

13. Reaching us

For a question about what is held, a correction, or a request this page does not cover, write to contacto@sunturai.com. A problem with content, attribution or a licence in the catalogue goes to the same address, and content and licensing says what to include so it can be acted on.

This notice describes engineering behaviour rather than making legal claims, and it does not claim compliance with any particular framework or certification. Where that matters to you, treat what is written here as an accurate description of the system and the absence of the rest as exactly that — an absence, not an implication.

14. Changes to this notice

This notice changes when the system does. The version on this page is always the current one and carries the date it last changed, shown at the top.

If a change means Detections starts collecting something it did not collect before, that is a change to this page and not a footnote elsewhere.