Request Early Access

Updated on June 13, 2025

Updated on June 13, 2025

Privacy policy

At Heist, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your personal information when you use our penetration testing platform and security services.

At Heist, your privacy is important to us. This Privacy Policy explains how we collect, use, and protect your personal information when you use our penetration testing platform and security services.

Definitions

Heist AS (“Heist”, “we”, “us”, “our”) provides an autonomous penetration testing platform enabling customers to run continuous application security tests (the “Service”). The Service is only available to authorised users under our Terms of Use. An authorised user will be referred to as “user” or “you”.

In order to provide the Service, Heist processes certain personal data. This Privacy Policy provides information about Heist’s processing of your personal data.

Heist AS (“Heist”, “we”, “us”, “our”) provides an autonomous penetration testing platform enabling customers to run continuous application security tests (the “Service”). The Service is only available to authorised users under our Terms of Use. An authorised user will be referred to as “user” or “you”.

In order to provide the Service, Heist processes certain personal data. This Privacy Policy provides information about Heist’s processing of your personal data.

The information we collect

In order to provide the Service, Heist may process certain information about users, such as:

  1. Information about users: name, work email, phone number, role, company, and other relevant contact details.

  2. Information about use of the Service: account activity, support enquiries, communications with us, and configuration information needed to deliver the Service.

  3. Information about your computer and access: IP address, device and browser information, and log/telemetry data processed for system administration, reliability, and security.

  4. Cookies: Heist uses cookies and similar technologies to enhance user experience and optimise the Service. Our website is built on Framer and uses minimal, primarily anonymous analytics and essential cookies. You can detect and delete cookies by changing browser settings. If you choose not to accept cookies, some functionality may be limited.

Heist may also process Customer Data that customers submit to the Service for testing. Customers typically provide target domains, test-user credentials, API schemas, and any additional context needed to run tests. Heist does not intentionally collect end‑user PII. However, tests may incidentally access personal data that exists in the target application. Any such data is only processed to perform the tests under customer instructions and is not used for any other purpose. Customers are controllers of Customer Data and Heist acts as processor of such data under the customer contract.

In order to provide the Service, Heist may process certain information about users, such as:

  1. Information about users: name, work email, phone number, role, company, and other relevant contact details.

  2. Information about use of the Service: account activity, support enquiries, communications with us, and configuration information needed to deliver the Service.

  3. Information about your computer and access: IP address, device and browser information, and log/telemetry data processed for system administration, reliability, and security.

  4. Cookies: Heist uses cookies and similar technologies to enhance user experience and optimise the Service. Our website is built on Framer and uses minimal, primarily anonymous analytics and essential cookies. You can detect and delete cookies by changing browser settings. If you choose not to accept cookies, some functionality may be limited.

Heist may also process Customer Data that customers submit to the Service for testing. Customers typically provide target domains, test-user credentials, API schemas, and any additional context needed to run tests. Heist does not intentionally collect end‑user PII. However, tests may incidentally access personal data that exists in the target application. Any such data is only processed to perform the tests under customer instructions and is not used for any other purpose. Customers are controllers of Customer Data and Heist acts as processor of such data under the customer contract.

Purpose and legal basis for the processing

Heist will only process personal data for the purposes stipulated in this Privacy Policy. The processing is based on the following legal bases and purposes:

Processing to fulfil the agreement for use of the Service

  1. to enable the use of the Service, including creating and maintaining user accounts and granting access;

  2. to respond to questions or inquiries relating to the Service, our Terms of Use, or this Privacy Policy; and

  3. to notify users of changes to the Service, the Terms of Use, or this Privacy Policy.

Processing to pursue Heist’s legitimate interests

Provided that the interests of the data subjects do not override such interests:

  1. to improve the Service, its content, and user experience;

  2. to maintain, monitor, and strengthen security, prevent fraud, abuse, or loss, and protect Heist, our customers, users, and third parties; and

  3. to communicate with business users about the Service, including marketing to existing and prospective business customers. We use Loops.so to manage business marketing and lifecycle emails.

Processing necessary for compliance with legal obligations

  1. continued storage due to statutory rules of storage for accounting, compliance, or lawful requests.

Heist will only process personal data for the purposes stipulated in this Privacy Policy. The processing is based on the following legal bases and purposes:

Processing to fulfil the agreement for use of the Service

  1. to enable the use of the Service, including creating and maintaining user accounts and granting access;

  2. to respond to questions or inquiries relating to the Service, our Terms of Use, or this Privacy Policy; and

  3. to notify users of changes to the Service, the Terms of Use, or this Privacy Policy.

Processing to pursue Heist’s legitimate interests

Provided that the interests of the data subjects do not override such interests:

  1. to improve the Service, its content, and user experience;

  2. to maintain, monitor, and strengthen security, prevent fraud, abuse, or loss, and protect Heist, our customers, users, and third parties; and

  3. to communicate with business users about the Service, including marketing to existing and prospective business customers. We use Loops.so to manage business marketing and lifecycle emails.

Processing necessary for compliance with legal obligations

  1. continued storage due to statutory rules of storage for accounting, compliance, or lawful requests.

Your rights

Users have the right to cancel their registration with the Service at any time. Upon such cancellation, personal data will be deleted unless statutory obligations or legitimate interests require or allow continued storage. Anonymised information that cannot be linked to you may be subject to continued storage.

To exercise the right to (i) obtain information about which of your personal data we process, (ii) change, update or correct personal data, (iii) request deletion, (iv) request restriction or object to processing under certain circumstances, or (v) request data portability, you can contact Heist via the contact details in the Contact section below.

If your request relates to Customer Data processed on behalf of a customer, please contact that customer. We will assist customers in responding to such requests where required.

Users have the right to cancel their registration with the Service at any time. Upon such cancellation, personal data will be deleted unless statutory obligations or legitimate interests require or allow continued storage. Anonymised information that cannot be linked to you may be subject to continued storage.

To exercise the right to (i) obtain information about which of your personal data we process, (ii) change, update or correct personal data, (iii) request deletion, (iv) request restriction or object to processing under certain circumstances, or (v) request data portability, you can contact Heist via the contact details in the Contact section below.

If your request relates to Customer Data processed on behalf of a customer, please contact that customer. We will assist customers in responding to such requests where required.

Retention period

Heist retains personal data for as long as necessary to fulfil the purposes defined above, and as a main rule deletes personal data upon cancellation of the registration with the Service or at your request. Legal obligations (e.g., accounting rules) may make it necessary to store personal data after cancellation. Continued storage may also occur where necessary for legitimate interests pursued by Heist, including establishing, exercising, or defending legal claims.

Pentest reports and related Customer Data are stored until the customer requests deletion, unless continued storage is required by law. Customer Data is deleted or returned upon request, unless we must retain it for legal reasons.

Heist retains personal data for as long as necessary to fulfil the purposes defined above, and as a main rule deletes personal data upon cancellation of the registration with the Service or at your request. Legal obligations (e.g., accounting rules) may make it necessary to store personal data after cancellation. Continued storage may also occur where necessary for legitimate interests pursued by Heist, including establishing, exercising, or defending legal claims.

Pentest reports and related Customer Data are stored until the customer requests deletion, unless continued storage is required by law. Customer Data is deleted or returned upon request, unless we must retain it for legal reasons.

Disclosure to third parties

Heist may disclose personal data to third‑party vendors and hosting partners who perform services for Heist in order to deliver the Service (such as cloud hosting, monitoring, analytics, and support tooling). These vendors will only use personal data for the purposes it was collected and to perform services for Heist. The relationship with such vendors is governed by a data processing agreement.

A current list of subprocessors is maintained on our subprocessor page.

If we transfer personal data to recipients outside the EU/EEA or the UK, we will take necessary precautions to ensure processing in accordance with applicable laws, including entering into agreements securing a proper level of protection.

Except as described in this Privacy Policy, we will not transfer, sell, rent, or exchange users’ personal data with any third party without obtaining your consent, unless required by law, binding court order, or necessary in a business transaction.


Heist may disclose personal data to third‑party vendors and hosting partners who perform services for Heist in order to deliver the Service (such as cloud hosting, monitoring, analytics, and support tooling). These vendors will only use personal data for the purposes it was collected and to perform services for Heist. The relationship with such vendors is governed by a data processing agreement.

A current list of subprocessors is maintained on our subprocessor page.

If we transfer personal data to recipients outside the EU/EEA or the UK, we will take necessary precautions to ensure processing in accordance with applicable laws, including entering into agreements securing a proper level of protection.

Except as described in this Privacy Policy, we will not transfer, sell, rent, or exchange users’ personal data with any third party without obtaining your consent, unless required by law, binding court order, or necessary in a business transaction.


Modifications to the Privacy Policy

Heist reserves the right to modify this Privacy Policy from time to time. The most recent revision supersedes earlier versions. The current version will be available on our website or in the Service. We advise that you check the Privacy Policy periodically. We will notify you of changes that require your consent.

Heist reserves the right to modify this Privacy Policy from time to time. The most recent revision supersedes earlier versions. The current version will be available on our website or in the Service. We advise that you check the Privacy Policy periodically. We will notify you of changes that require your consent.

Contact us

If you have questions or concerns about this privacy policy or our data practices, please contact us at: privacy[at]heisthq.com

If you have questions or concerns about this privacy policy or our data practices, please contact us at: privacy[at]heisthq.com

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access

Get ahead of your vulnerabilities. Run your pentests with Heist.

Request Early Access