Last updated: September 2026
1. Who we are
Solsignia is a product family developed and operated by Reliance Hive srl, a company registered in Romania.
Reliance Hive srl
Valea Lupului 707410, Iași, Romania
Registration number: 42010352
Contact: hello@solsignia.com
As a company established in Romania, we operate under Romanian law and the EU General Data Protection Regulation (GDPR). Reliance Hive srl is the data controller for all personal data processed through Solsignia products.
2. What this policy covers
This policy applies to all Solsignia products: Solsignia Postura (postura.solsignia.com), Solsignia Pharus (pharus.solsignia.com), and Solsignia Nexum (nexum.solsignia.com). Product-specific details are described in Sections A, B, and C below.
3. Solsignia accounts
Solsignia offers a single account system shared across all products. A Solsignia account is created once and works across every product in the family. Account registration requires an email address and a password. Accounts are free to create. Individual products may offer paid subscription tiers that unlock additional features — subscriptions are purchased per product independently.
When you create a Solsignia account we collect and store: your email address, your chosen password (stored as a secure hash — never in plaintext), your profession (optional, used to personalise product experiences), and your account creation date.
We use your email address to: authenticate your identity, send reassessment reminders and product notifications (where you have opted in), and communicate material changes to these terms or this policy.
Account data is stored in Supabase (EU West, Ireland). You may delete your account at any time by contacting hello@solsignia.com. Account deletion removes your personal identifiers and linked data within 30 days.
Note: Solsignia accounts are not yet available. This section describes planned functionality that will be implemented in a future release. This policy will be updated when accounts launch.
Solsignia Nexum does not participate in the account system — it is and will remain an anonymous-only product.
4. Infrastructure and processors
We use the following third-party services to operate our products. Each acts as a data processor on our behalf:
Vercel Inc. (San Francisco, USA) — hosting and serverless function execution. Vercel processes request metadata including IP addresses and HTTP headers when our API routes are called. Vercel is certified under the EU-US Data Privacy Framework and operates under Standard Contractual Clauses. Log retention is configured to the minimum available period. Note: on our current plan, functions execute in the USA (Washington D.C.). We intend to migrate to EU-based execution regions as our infrastructure scales.
Supabase Inc. (San Francisco, USA) — database and file storage, hosted on EU West (Ireland) infrastructure. Supabase stores the data described per product below. Supabase operates under Standard Contractual Clauses.
Sendinblue SAS (Brevo) (Paris, France) — transactional email delivery. Brevo processes the recipient email address and the message content for account-related emails (e.g. account deletion confirmation). Brevo is an EU-based processor operating under GDPR. Data is not used for any purpose beyond delivery of the specific email.
Pwned Websites Pty Ltd (HaveIBeenPwned) (Australia) — breach data provider used by Solsignia Vigil. Email addresses are transmitted to HaveIBeenPwned's API to retrieve breach records. HaveIBeenPwned's own privacy policy applies to that transmission. No data is stored by HaveIBeenPwned on our behalf.
5. General data practices
We do not sell personal data to any third party. We do not display advertising, and no advertiser has any access to data processed through our products. We do not use tracking cookies or behavioral analytics. We collect only what is necessary to operate each product.
6. Your rights under GDPR
As a data subject under the GDPR you have the right to: access your personal data; request correction or erasure; object to or restrict processing; request data portability; lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro).
To exercise any of these rights, contact us at hello@solsignia.com. We will respond within 30 days.
7. Changes to this policy
We may update this policy as our products evolve. The date at the top of this page reflects the most recent revision. We will not materially reduce your rights without notice.
Section A — Solsignia Postura
Solsignia Postura (postura.solsignia.com) is a GDPR and NIS2 security posture assessment tool for EU-licensed solo professionals.
Anonymous use: no account required. We collect your profession selection and your responses to the 31-question security assessment. This data is used solely to generate your personalised report and PDF. No name, email, or persistent identifier is collected or stored. Assessment data is not linked to any individual.
Registered use (planned): when Solsignia accounts launch, registered users will be able to save their assessment results, track progress over time, receive quarterly reassessment reminders, access regulatory and incident alerts by profession, and activate a verifiable trust badge when their score reaches 70. Registered assessment data will be linked to the user's Solsignia account and retained for as long as the account is active. Users may request deletion of their assessment history at any time.
Paid subscription (planned): the Postura paid tier (€15/month or €149/year) unlocks the trust badge, public trust page, peer benchmarking, score history, score degradation tracking, incident and regulatory alerts, and full report history. Payment is processed by a third-party payment provider — details will be added to this policy when billing is implemented.
Helper scan data: when the Solsignia Helper is installed and run on a device, it performs a local read-only security scan and transmits the results to Postura via an encrypted relay. Scan results may include: open port listings, detected service versions, assessed credential risk indicators, and the device's local network address. No data is read from or written to the scanned device beyond what is required to perform the assessment. Scan results are associated with a randomly generated submission identifier, not with a named individual unless the user has a Solsignia account.
Regulatory and incident data: Postura retrieves regulatory update and incident alert data for registered users based on their stated profession. This data is stored in association with the user's account and is used solely to populate their Postura dashboard.
Retention (anonymous): anonymous submission records (assessment responses and helper scan results) are deleted automatically after 24 months. Regulatory raw data that has been processed into alerts is deleted after 6 months.
Retention (registered): registered assessment data and scan history are retained for as long as the account is active and deleted within 30 days of account deletion.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — providing the requested service to you.
Section B — Solsignia Pharus
Solsignia Pharus (pharus.solsignia.com) is a home and small office network security scanner.
What we collect: when you initiate a network scan, the Pharus helper runs locally on your Windows machine and transmits scan results to our servers via an encrypted relay. Scan results stored on our servers may include: detected device hostnames, open port listings, detected service versions, and assessed risk indicators for devices on your local network. IP addresses of scanned devices are local network addresses (RFC 1918) and do not identify individuals on the public internet.
Relay requests: scan relay messages are stored temporarily with an expiry timestamp. Expired relay records are deleted automatically when the expiry is reached.
What we do not collect: your public IP address is processed by Vercel as described in Section 4 but is not stored in our own database. No credentials, file contents, or user activity beyond network topology and port/service data are transmitted.
Retention: scan result records are deleted automatically after 12 months. Expired relay records are deleted when their expiry timestamp is reached.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — providing the requested network security scanning service to you.
Section C — Solsignia Nexum
Solsignia Nexum (nexum.solsignia.com) is a zero-knowledge sealed transfer tool for sending encrypted files and messages.
Encryption key: never collected. The encryption key is generated in your browser and embedded only in the link you share. It never reaches our servers under any circumstances.
Transfer content: never in plaintext. All content is encrypted client-side in your browser before upload. We store only the ciphertext — encrypted data that we are technically unable to read or decrypt.
Transfer metadata: we store the following in our database, linked only to a randomly generated transfer ID (UUID): encrypted payload reference, initialisation vector (IV), salt, whether a passphrase was set (boolean — not the passphrase itself), expiry timestamp, one-time-open flag and opened status, total size and file count, creation timestamp. No personal identifiers are stored in transfer metadata for anonymous users.
Request metadata: when you call our API, Vercel processes your IP address and request headers as described in Section 4. We do not log or store IP addresses in our own database.
Passphrase: the passphrase you set is never transmitted to or stored on our servers. It exists only in your browser at the moment of encryption, and in whatever separate channel you use to share it with the recipient.
Relay requests: when a transfer is in progress, a temporary relay record is stored on our servers to coordinate the encrypted exchange. Relay records carry an expiry timestamp and are deleted automatically when the expiry is reached, independently of the transfer record itself.
Retention: transfer ciphertext and metadata are deleted automatically when the transfer is opened (one-time-open) or when the expiry timestamp is reached (maximum 24 hours for anonymous users), whichever comes first. Expired relay records are deleted when their expiry timestamp is reached. After deletion, the content is permanently unrecoverable by anyone, including us.
Zero-knowledge statement: Reliance Hive srl has no technical capability to access, read, or recover the content of any Nexum transfer. This is by design and constitutes a core security guarantee of the product.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — providing the requested encrypted transfer service.
Section D — Future products
As new Solsignia products are released, additional sections will be added to this policy. We will update the date at the top of the page when this occurs.
Section E — Solsignia Vigil
Solsignia Vigil (vigil.solsignia.com) is a data breach monitoring service for EU professionals. Vigil monitors email addresses and domains against known breach databases and provides guided remediation tools aligned with GDPR and NIS2 obligations.
Data collected: email addresses submitted for breach checking, domain names added for monitoring, DNS verification tokens, breach data retrieved from HaveIBeenPwned, and remediation action status.
HIBP as data processor: breach data is retrieved from HaveIBeenPwned (haveibeenpwned.com), operated by Pwned Websites Pty Ltd. Email addresses are transmitted to HIBP's API for breach lookup. HIBP's privacy policy applies to that transmission.
Anonymous checks: email addresses submitted on the Vigil landing page are not stored unless the user creates an account. Anonymous checks are transmitted to HIBP but not persisted in our systems.
Domain verification: DNS TXT verification tokens are generated and stored until verification is complete, then retained as proof of domain ownership.
Trust badge public page: the badge holder's domain name and monitoring status are publicly accessible at vigil.solsignia.com/trust/[slug]. No personal information beyond the monitored domain name is displayed on public pages.
Retention: monitored email and domain data is retained while the account is active. Breach records for email addresses that are no longer monitored are deleted automatically. Completed remediation actions are deleted after 24 months. Domain risk score records are deleted after 24 months. All remaining associated data is deleted within 30 days of account deletion.
Legal basis: Art. 6(1)(b) GDPR — performance of a contract with the user.