개인정보 및 데이터 보호

At SecureStamp we take the privacy of our users very seriously. This policy describes how we collect, use, protect and share personal information when using the service available at securestamp.online.

1. Data controller

The data controller for personal data processing is:

1.1 Applicable data protection frameworks

SecureStamp is available internationally. Depending on where you live, different frameworks govern the processing of your data, and this policy applies under all of them cumulatively:

• European Economic Area and United Kingdom: the General Data Protection Regulation (GDPR) and, in Spain, the LOPDGDD. We act as a controller established outside the Union offering services to data subjects in the Union.
• United States: applicable federal and state law, including the California CCPA/CPRA where its thresholds are met.
• Argentina and Latin America: Personal Data Protection Act 25.326 and equivalent local rules.

Where two frameworks differ, we apply the standard more protective of the data subject. We do not condition rights on where you live: the rights of access, rectification, erasure, portability and objection described in section 8 are offered to every user regardless of residence.

2. What data we collect

2.1 Data you provide directly

• Account: name (optional), email address, password (hashed, never stored in plain text)
• Billing: name, billing email. Credit card data is processed directly by Stripe and never stored on our servers
• Domains: domains you register for verification, along with their public DNS records
• Official channels: phones, handles, bots, links, domains and channels you declare for Signal or for your organization’s trust perimeter
• Counterparties and policies: data you load into features such as VendorShield, including counterparty names, domains, emails, declared rules and monetary instructions represented as fingerprints or masks where applicable
• Contact: name, company and message when filling out the Enterprise inquiry form
• Waitlist: email and optional name for plugins under development

2.2 Automatically generated data

• IP address (anonymized for analytics)
• Browser type and operating system
• Access date and time
• Emails or domains verified through the plugin (only the sender’s domain/email address, never the email content)
• Signal queries for channels, links, numbers or handles (only the normalized value or fingerprint needed to verify official-perimeter membership)
• Action trust checks, receipts, verdicts and audit events needed to show history, evidence and service reports
• Number of verifications performed

2.3 What we do NOT collect

• The content, subject, attachments or body of your emails
• Your email passwords or access to third-party accounts
• Biometric data or sensitive information as defined by law

2.4 Chrome Extension for Gmail

The SecureStamp browser extension for Gmail (Chrome Web Store, ID libceamdlacklkcnedklmhcjeeffmnao) verifies sender authenticity and, optionally, lets you send signed or end-to-end-encrypted emails. The following describes, permission by permission, what data it collects, how it manages and stores it, and with whom it is shared. No section is omitted.

Browser permissions and why we request them

• storage — Preferences and minimal local state. Saves your preferences, usage counters and the last trust stamp shown. It never contains email content.
• unlimitedStorage — Private cryptographic key (Confidential Mail). Durably stores your private cryptographic key (a non-extractable CryptoKey kept in IndexedDB) required to read your end-to-end encrypted emails. This permission prevents the browser from evicting the key under storage pressure; if it were lost, you could no longer decrypt your emails. We do not store bulk data or email content — only the key and minimal metadata. The key never leaves your device and is never transmitted to our servers.
• notifications — Security alerts. Shows a notification when a blocked or high-risk sender is detected, warning you of a possible phishing attempt.
• identity — Google OAuth token. Uses chrome.identity to obtain a Google OAuth access token to call the Gmail API with the scopes described below. The token is issued by Google, held in memory during the session, and is not stored on our servers.
• Host permissions (mail.google.com, googleapis.com, securestamp.online) — inject the SecureStamp button and stamp into the Gmail interface and enable communication with the Gmail API and the SecureStamp API.

Gmail API permissions (OAuth scopes)

• gmail.metadata — Read headers only. Allows reading the From, To and Subject headers of the opened email: the sender to compute the trust score, and the full envelope (sender/recipients/subject) to verify the integrity of the ES256 notarial seal. This scope grants no access to the body or attachments of the email.
• gmail.send — Send only at your request. Allows sending signed or encrypted emails only when you explicitly request it (when using the signed-send / Confidential Mail feature). The extension never sends email automatically or without your action.

Data collected by the extension

• Sender email and domain: read from the opened email (via gmail.metadata) to check whether the sender is authenticated and whether the domain holds an active trust stamp.
• User email address: to associate verifications with your SecureStamp account when you are signed in.
• Local verification state: a cache of recent results in chrome.storage.local (maximum 7-day TTL) to avoid repeated API calls.

Data the extension does NOT collect

• The body, attachments or any other content of your emails (the Subject header is read only transiently to verify the notarial seal; it is never used for analytics or stored locally)
• Your Google passwords or any other account passwords
• Full mailbox history or Gmail labels
• Data from other websites or browser tabs

How this data is managed and stored

• Transmission: the extension sends only the sender email/domain to the SecureStamp API (https://securestamp.online/api) over HTTPS with TLS 1.3. Gmail API calls go directly to Google’s servers.
• Server storage: verification records (sender email/domain, timestamp, trust result) are stored in AWS DynamoDB in the us-east-1 region, encrypted at rest with AES-256. Records are retained for 90 days in aggregated form and then permanently deleted.
• Local storage: the result cache in chrome.storage.local (7-day TTL) and the private cryptographic key in IndexedDB reside exclusively on your device and are never transmitted to any server.
• OAuth token: issued and managed by Google; held in memory during the session to call the Gmail API and not stored on our servers.

How this data is shared

• Sender data is never sold or shared with third parties for advertising, marketing or any other purpose.
• Data is only transmitted to SecureStamp servers (AWS us-east-1) solely to compute the sender trust score, and to Google’s Gmail API for the sender-read and signed-send operations you request.
• SecureStamp’s use of information received from Google APIs adheres to the Chrome Web Store Limited Use policy, including its Limited Use requirements.

User controls

• You can disable or uninstall the extension at any time from chrome://extensions. Uninstalling automatically removes all locally stored data (including the cryptographic key).
• You can revoke the extension’s OAuth access from your Google Account security settings.
• To request deletion of verification records stored on our servers, email privacy@securestamp.online.

2.5 Outlook Add-in (Office Add-in)

The SecureStamp add-in for Outlook (available on Microsoft AppSource and via manifest URL) operates with the ReadWriteItem Office API permission. Below is an exact description of what data is accessed in each mode.

Read mode — sender verification

• Sender name and email address: read from the open message header (item.from). Sent to the SecureStamp API to compute the trust score.
• Message internet headers: read via item.internetHeaders.getAsync() to detect the X-SecureStamp field, which indicates whether the sender digitally signed the email.
• User email address: retrieved from the Office.js mailbox object to associate the verification with your SecureStamp account.

Compose mode — stamp insertion

• The add-in writes an HTML identity block at the top of your outgoing email via item.body.prependAsync().
• The add-in does NOT read the body of the email you are composing, nor does it transmit it to any server.
• It does not access recipients (To, CC, BCC) in any mode.

What the add-in does NOT collect

• The body, subject or attachments of emails you read or compose
• Recipient lists (To, CC, BCC)
• Previous emails, folders or calendar data
• Office 365 credentials or Microsoft session tokens

How this data is managed and stored

• Transmission: only the sender email and domain are sent to https://securestamp.online/api over HTTPS with TLS 1.3. The add-in loads its UI from https://securestamp.online/outlook/taskpane.html.
• Server storage: identical to the Chrome extension — DynamoDB us-east-1, AES-256 encryption at rest, 90-day aggregated retention.
• No local Office storage: the add-in does not use Office RoamingSettings or CustomProperties to store personal data.

How this data is shared

• Data is never sold or shared with Microsoft or any third party for advertising or other purposes.
• It is used solely on SecureStamp servers to compute the sender trust score.

User controls

• The add-in can be uninstalled by the user from Outlook Settings → Add-ins, or by an IT administrator from the Microsoft 365 Admin Center.
• To delete server-side records: privacy@securestamp.online.

2.6 On-device AI analysis and anonymous telemetry

The extensions include an AI classifier that runs locally on your device (an embedded WebAssembly model). The analysis of email content to detect phishing, scam, or spam signals happens entirely in your browser: the message body is never transmitted to SecureStamp or any server for that analysis.

Optionally, to improve model quality, the extension may send an anonymous, content-free report to /api/ml/report containing only: four numeric scores between 0 and 1 (scam, obscene, commercial, personal), the resulting risk level (safe / suspicious / dangerous), the message length as a number, the source client (gmail, outlook…), the locale, and the model version. No email text, phrases, subjects, addresses, or user identifiers are sent.

Likewise, product events sent to /api/events contain only the plan tier, the event name, and the risk level — never email addresses or sender data. The AI model is downloaded from /api/ml/model/latest and runs locally; SecureStamp never receives what the model analyzes.

2.7 MCP Guard and the Agent Trust Layer

MCP Guard is the service at mcp.securestamp.online that lets an AI agent (Claude Desktop, Cursor, or any MCP-compatible client) ask SecureStamp for proof of intent before performing a sensitive action. MCP Guard authorizes, verifies and challenges: it never moves money or deletes data.

When you use MCP Guard we process:

• Access credentials: workspace API keys and, if you authorize an agent to act on your behalf, expiring delegated session identifiers
• An abstract description of the action: the requested action type, its risk level, the target in masked form, and a cryptographic fingerprint of the instruction
• A record of the decision: the verdict issued, when it was issued, and the signed receipt attesting it, so you can audit it later
• Billing metadata: the count of protected actions, for plan metering

The full content of the instruction is not stored. The fingerprint is a one-way function: it lets us confirm that what was approved is exactly what was executed, without retaining the original text or being able to reconstruct it. Delegated sessions expire automatically and you can revoke them at any time from the dashboard.

2.8 SCIM provisioning for organizations

If your organization is on an Enterprise plan, it can connect its identity directory (Okta, Microsoft Entra, or another SCIM 2.0 provider) to create and deactivate user accounts automatically.

In this case the organization is the data controller and SecureStamp acts as processor: we process directory data solely on the organization’s instructions and under the data processing agreement signed with it. The data received is only what is needed to create and maintain the account: user identifier, email address, display name, and active or deactivated status.

If you are an employee of an organization using SecureStamp this way, information about the processing and the exercise of your rights is in the first instance a matter for your employer as controller. You may still write to us at privacy@securestamp.online and we will route your request to the controller without delay.

Deactivating a user in the source directory disables their SecureStamp access. Associated data is deleted under the timelines in section 7, or sooner if the organization asks.

3. How we use your data

• Service delivery: verifying domains, official channels and counterparties; processing trust requests; issuing PostalStamps, Trust Receipts and Action Receipts
• Account management: authentication, password recovery, plan administration
• Billing: processing payments, sending invoices, managing subscriptions
• Communications: service notifications, security alerts, plan updates
• Security: fraud detection, abuse prevention, anomalous pattern analysis
• Product improvement: aggregated and anonymized service usage analysis
• Legal: compliance with legal obligations and requirements of competent authorities

We do not use personal data for third-party advertising and do not sell data to any third party.

4. Legal bases

• Contract performance: data necessary to deliver the contracted service
• Consent: marketing communications (you may withdraw consent at any time)
• Legitimate interest: service security, fraud prevention, product improvement
• Legal obligation: response to requirements from competent authorities

5. Who we share data with

5.1 Processors and sub-processors

This is the complete list of third parties that process personal data on our behalf. Each is bound by a data processing agreement and processes data only on our instructions.

• Amazon Web Services (AWS): cloud infrastructure — DynamoDB (database), S3 (encrypted attachment storage), KMS (key custody), Cognito (authentication), SNS (notifications) and Secrets Manager. Servers in us-east-1 region (Virginia, USA)
• Stripe and Stripe Connect: payment processing and artist payouts. We never store card data; it is subject to Stripe’s privacy policy
• Vercel: web application hosting
• avnam: delivery of all outbound email over SMTP (transactional messages and notifications)
• Cloudflare: Turnstile, anti-abuse verification on forms. Processes IP address and browser device signals
• Kapso: gateway for the SecureStamp Signal bot on WhatsApp Business
• Telegram: gateway for the SecureStamp Signal bot on Telegram
• Identity providers (OAuth): Google, Microsoft Entra, Apple and Facebook, only if you choose to sign in with them

We keep this list current at securestamp.online/subprocessors. If we add or replace a processor handling personal data, we update that page before the change takes effect.

5.4 When we process data on your organization’s behalf

If your organization uses SecureStamp with SCIM provisioning, Signal lookups on behalf of a brand, or MCP Guard delegated sessions, we act as processor and the processing is governed by our Data Processing Agreement, which forms part of the Terms of Service and needs no separate signature.

5.2 Legal disclosure

We may disclose information when required by law, court order or competent governmental authority, or when necessary to protect rights, property or safety of SecureStamp, its users or third parties.

5.3 Business transfer

In the event of a merger, acquisition or asset sale, data may be transferred to the acquirer, who will be required to comply with this policy or notify you before any material changes.

6. International transfers

Arche Software Studio Inc. is incorporated in Delaware, USA, and all production infrastructure lives in the AWS us-east-1 region (Virginia, USA). If you live outside the United States, your data is transferred there.

6.1 From the EEA, United Kingdom and Switzerland

These transfers rely on the Standard Contractual Clauses adopted by the European Commission in 2021, incorporated into our processors’ data processing agreements. Specifically: the AWS GDPR Data Processing Addendum forms part of the AWS Service Terms and incorporates the SCCs; Stripe’s Data Processing Agreement forms part of the Stripe Services Agreement and likewise incorporates the SCCs, and Stripe is additionally certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

6.2 From Argentina and Latin America

These transfers are carried out with adequate safeguards under Personal Data Protection Act 25.326 and under the same data processing agreements with each processor.

Whatever the origin, we apply the same technical measures described in section 10: encryption in transit and at rest, role-restricted internal access, and audit logging of every access.

7. How long we retain your data

• Active account data: while the account is active
• Cancelled account data: 90 days after cancellation (to fulfill legal obligations), then permanent deletion
• Verification records: 90 days in aggregated form, then deleted
• Billing data: 10 years per Argentine tax obligations
• Waitlist data: until the corresponding plugin launches or until you request deletion

8. Your rights

Under applicable data protection law, you have the right to:

• Access: request what personal data we hold about you
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data (“right to be forgotten”)
• Portability: receive your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Consent withdrawal: revoke consent given for specific uses

To exercise these rights, contact privacy@securestamp.online. We respond within a maximum of 30 calendar days, extendable with reasons where a request is particularly complex. We do not charge for handling these requests and we do not treat you differently for making one.

8.1 Additional rights if you live in California

In addition to the above, the CCPA/CPRA gives you the right to know the categories of personal information collected and the third parties it is shared with, to request its deletion or correction, and to limit the use of sensitive personal information. We do not sell or share personal information as those terms are defined in that law, and we have not done so in the twelve months preceding the last update of this policy.

8.2 Complaining to a supervisory authority

If you believe we have not handled your request properly, you may complain to the authority competent where you live:

• Spain: Agencia Española de Protección de Datos (AEPD)
• Rest of the EEA: the supervisory authority of your member state of residence or of the place of the alleged infringement
• Argentina: Agencia de Acceso a la Información Pública (AAIP)
• United States: the Federal Trade Commission and, in California, the California Privacy Protection Agency

We would appreciate hearing from you first: we can almost always resolve things faster than an administrative procedure.

9. Cookies and similar technologies

9.1 Strictly necessary cookies

We use session cookies for authentication and service operation. These cookies cannot be disabled without affecting site functionality.

9.2 We do not use analytics cookies

As of today we do not use analytics or audience-measurement cookies, first-party or third-party. There is no Google Analytics, Plausible, PostHog or any other analytics script in our applications.

If we later add analytics requiring non-essential cookies, we will not switch them on silently: we will update this section and ask for your prior consent through an explicit opt-in, as European electronic-communications privacy rules require. Until then there is nothing to accept or reject.

9.3 No advertising cookies

We do not use advertising cookies or third-party tracking for advertising purposes, and we do not sell or share personal data for behavioral advertising.

10. Data security

We implement technical and organizational measures to protect your data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Two-factor authentication available for all accounts
• Internal access restricted by role (principle of least privilege)
• Regular security audits
• Anomaly monitoring and automatic alerts

In case of a security breach affecting your data, we will notify you within 72 hours of detection.

11. Confidentiality and internal access

Access to user personal data is restricted exclusively to staff and systems that need that information to deliver the service. All internal access is recorded in audit logs. SecureStamp staff is subject to confidentiality obligations and cannot access the content of user emails under any circumstances.

An organization’s data (domains, authorized senders, configuration) is confidential and is not shared with other users or organizations on the service.

Private Signal, VendorShield and Action Trust data —such as counterparties, declared channels, policies, monetary-instruction fingerprints, receipts and audit events— is used to deliver the service, show history and generate verifiable evidence. It is not used to assert fraudulent intent or certify the truth of message content.

Notarial records (seals and verification)

When a seal is issued, SecureStamp keeps a notarial record designed to minimize data: we never store the message body. The record contains a cryptographic hash of the envelope (headersHash = SHA-256 of sender, recipients, subject, and metadata), recipients stored as HMACs (not in clear), the sender domain, the trust score and level, and timestamps. It lets a third party verify origin and integrity without SecureStamp retaining the content.

SecureStamp Signal (channel trust)

In Signal we store only the normalized fingerprint of the queried channel (e.g. telegram:brand), never the content of the forwarded message. Each Trust Receipt is a signed, dated voucher.

Action Trust and VendorShield

For Action Trust and VendorShield, SecureStamp may store verdicts, safe next steps, receipt IDs, challenge states, declared counterparties and protected-operation metrics. Sensitive monetary instructions are compared using fingerprints and masks; they are not stored in plaintext unless an explicit encrypted feature is enabled for your organization.

Confidential Mail (end-to-end encryption)

For confidential email, content is encrypted on your device (E2EE). SecureStamp stores only public keys in the directory and minimal quota data; it cannot decrypt or read the content of confidential messages.

12. Minors

The service is not directed at children under 13. We do not intentionally collect data from minors. If we become aware that data has been collected from a minor without parental consent, we will delete it immediately.

13. Changes to this policy

We may update this policy periodically. Material changes will be notified by email at least 15 days in advance. The current policy will always be available at securestamp.online/ko/privacy.

14. Contact

We have not appointed a data protection officer because the triggers for a mandatory appointment do not apply: we do not carry out large-scale regular and systematic monitoring, nor do we process special categories of data at scale. Privacy enquiries are handled at the address above.