Privacy Policy
Last updated October 5, 2026
This policy explains what DeBough Systems LLC, an Arizona limited liability company (“DeBough,” “we”), collects when you use our website, dashboard, and DeBough Checkup app, and what we do with it.
The short version: we collect the minimum needed to show you what DeBough observed. We never collect your files, documents, emails, browsing, or passwords from your computers. We don't sell your data, and we don't use advertising or tracking cookies.
1. What we collect
Your account. Your email address, a securely hashed password (or email sign-in links), two-step sign-in settings if you turn them on, your company name, and your settings. If an owner invites a colleague to the dashboard, we keep the colleague's email address until they join, the invitation is cancelled, or within a week after it expires (14 days after it was sent).
From computers running DeBough Checkup. The name you give each computer, its operating system and version, and the results of its security checks: for example whether antivirus, the firewall, disk encryption, automatic updates, and backups are on; the names of known backup products; the names of known remote access apps (such as AnyDesk or TeamViewer) and endpoint detection and response (EDR) products found installed or running; which port numbers the computer's router says it forwards from the internet (never the addresses or names of devices on your network); the names and versions of installed apps that have updates waiting; the names of programs set to start automatically, of administrator accounts on the computer, and of browser extensions that can read every website; and the names and dates of recent threats Windows Security detected (never file paths). Checkup does not read or send your files, documents, emails, browsing history, passwords, Wi-Fi network names, or anything typed on the computer. Where a check involves a saved password (such as automatic sign-in), it only notes that one exists; it never reads it.
Microsoft 365, if you connect it. With the read-only access your Microsoft administrator approves, DeBough reads your organization's name and domains, user accounts and licenses, whether each person has a second sign-in method, security defaults and sign-in policies, administrators, last sign-in dates, and where inbox rules forward mail. We keep only the results: for example the names and email addresses of people missing two-step sign-in, and the outside domain a rule forwards to. We never read or keep message contents, attachments, or files. Once a day DeBough also compares a few of these signals with what it saw before (inbox rule identifiers, apps given access, administrators, and the countries people sign in from, where your license allows) so it can alert you to signs of a hacked account; it keeps only identifiers and country codes for that, never IP addresses or rule keywords.
Domains you add. The domain name and the results of checks on public information (DNS records, the website's certificate, domain registration, and registered lookalike domains). If you confirm you control a domain and check it for breached accounts, we also keep which addresses at that domain appear in known data breaches: only the part of each address before the @ and the names of the breaches, never passwords or other leaked data.
Spoofing reports. If you add DeBough's report address to your domain's DMARC record, email providers send DeBough daily reports about mail that used your domain. We keep only each report's totals: who sent the report, the dates it covers, and how many messages passed or failed your domain's sender checks. Not the messages, and not the addresses of the servers that sent them.
Emails you forward to be checked. If you forward an email to DeBough's checking address, we run the same checks as “Check an email” on your dashboard and reply with the result. We don't keep the email, with two exceptions: if it asks to change where payments go and your plan includes payment-change protection, we log who sent it and its subject line on your Payment changes page; and if your company uses DeBough Protect and the email looks like a scam, we add the domain names of its websites to your company's block list. The email passes through our email provider, Resend, which holds received mail for a limited time under its own policy. We only reply to people on a DeBough company's team or People list.
DeBough Protect, if your company uses it. The domain names on your company's block list, why each was added, and who added or unblocked it; and for each computer that approved Protect, when it last applied the list and how many entries it applied.
People you add for security lessons. Their names and work email addresses, which lessons were sent, when they were completed, and quiz scores. If you add staff, please let them know.
Your security plan answers. If you fill in the Security plan page, we keep your answers (such as who is responsible for security, whether two-step sign-in is used, and your insurer and IT contacts) and the names of service providers you list.
Payment changes you log. The vendor's name, the sender's email address, how the request arrived, the amount if you enter it, the warning signs DeBough found, and who called whom to verify it. Never bank account or routing numbers.
Insurance renewal. Your renewal date. If an owner creates a link for your insurance broker, anyone with that link can view your drafted renewal answers and the evidence behind them for 30 days, until the owner turns links off.
Billing. Your plan and its status, and Stripe's reference numbers for your account. Stripe collects and stores your card details; we never see them.
Service records. Basic records of how the Service is used (for example which feature was used and when, and how much AI processing it took). We record a one-way scrambled version of IP addresses, not the address itself, to limit abuse.
2. Things we look at but don't keep
- Emails you check for scams are analyzed and then discarded. If you ask for a plain-English explanation, the sender, subject, and the start of the message are sent to our AI provider to write it, and not stored by us.
- Security questionnaire questions you paste are sent to our AI provider with DeBough's observations to draft answers, and not stored by us.
- Files checked with our file checker are examined in your browser and never uploaded. Only a fingerprint (hash) is looked up against public malware databases, and if you ask for an explanation, the file's name and the check results are sent to our AI provider.
- Scan reports you ask us to email go only to an address at the domain that was scanned. We send that one email, and the founder receives a note with your email address, the domain, and its score so we can follow up if you want help. We don't add you to a mailing list.
3. How we use it
- To run the Service: show results, send the alerts, weekly summaries, and lessons you ask for, and guide fixes.
- To keep the Service reliable and protect it from abuse.
- To process payments and communicate with you about your account.
- To improve DeBough. We don't sell your data or use it for advertising.
4. Who helps us (service providers)
We use a small number of providers to run DeBough. They process data only to provide their service to us:
- Vercel hosts the website and dashboard.
- Supabase stores account and dashboard data and handles sign-in.
- Resend delivers our emails, and receives spoofing reports and emails forwarded to DeBough for checking.
- Anthropic provides the AI behind explanations, walkthroughs, and drafts. Its commercial terms say data sent through its API isn't used to train its models.
- Stripe processes payments.
- Microsoft provides the Microsoft 365 data you choose to connect, through its Graph API, under your administrator's approval.
- Have I Been Pwned tells us which addresses at a domain you've verified appear in known data breaches. We send it only the domain name.
We also look up public information about domains and software (for example DNS, domain registries, and CISA's list of actively exploited vulnerabilities). Those lookups share only the domain or product name, never information about you.
We may disclose information if the law requires it, or to protect the rights and safety of users or the public.
6. How long we keep it
We keep your data while your account is active so you can see history and trends. When you disconnect a computer, it stops sending data. If you ask us to delete your account, we delete its data within 30 days, except records we must keep for legal, tax, or billing reasons. Backups roll over on their own schedule.
7. Security
Data is encrypted in transit. Each company can only see its own data. Device tokens, enrollment codes, and lesson links are stored only as one-way hashes. You can turn on two-step sign-in for your account. No system is perfectly secure, so please tell us through our contact page if you find a problem.
8. Your choices and rights
- You can see and change most of your data in the dashboard, disconnect computers, remove people and domains, and unsubscribe from emails.
- You can ask us for a copy of your data, to correct it, or to delete it. Depending on where you live (for example California), you may have additional rights; we honor them and won't treat you differently for using them.
- Staff who received lessons can ask their employer, or us, to remove their details.
9. Children
DeBough is for businesses and adults. It isn't meant for anyone under 18, and we don't knowingly collect their data.
10. Where data is processed
DeBough is run from the United States, and our providers may process data in the United States and other countries.
11. Changes and contact
We'll update this page if our practices change and tell account owners about significant changes. Questions or requests? Use our contact page.