Privacy policy

Last updated: 16 October 2026.

This policy describes how the Tohou Sonar application handles account and workspace information. The current service operator and contact for privacy requests is Ichate, Switzerland: [email protected]. Tohou is not represented here as a registered legal entity.

Information processed

Discord sign-in supplies your Discord user ID, display name, email address and avatar as associated with your Discord account. Sonar does not access your server memberships or messages. We store workspace membership, submitted targets, verification challenges, scan results, findings, comments, API-key metadata (including Index API key metadata) and posture score snapshots. API secrets are stored as hashes. Saved Discord webhook URLs and authenticated test credentials are encrypted. One latest service screenshot may be stored per observed web host.

Purpose and sharing

We use this information to authenticate users, verify scope, provide scans and reports, enforce limits and investigate misuse. Workspace data is accessible to authorized workspace members and the operator responsible for maintaining the service. We do not sell workspace data or publish it in a global index.

Discord processes authentication and receives notification content when you configure a Discord or Slack incoming webhook. Domain and brand lookups send the queried name to public certificate-transparency services. Public Index lookups send the queried domain or address to third-party public record services: public certificate-transparency logs, public web-observation services, registration directories, regional internet registries, geolocation data providers and public routing data. Domain lookups also resolve public DNS records. DNS resolvers and target systems receive the network queries needed for verification and scanning. Hosting and network providers process traffic and stored service data as part of operating the infrastructure.

When an administrator imports a CycloneDX software inventory for a verified asset, Sonar sends versioned package URLs to a public open-source vulnerability database to check for known vulnerabilities. The uploaded document is processed in memory and is not retained; Sonar stores its digest, component count and resulting workspace findings.

ASN coverage requests send the ASN to a public routing-data service and store the returned public BGP prefixes in the requesting workspace. These routes are passive observations, not proof of asset ownership. Written authorization submitted for operator review is encrypted at rest and accessible to the platform operator for that review. It is retained with the workspace authorization record and removed when the prefix or workspace is deleted. Company coverage labels and their links to already verified domains are workspace-private.

The Tohou Index is stateless. Searches and their results are never written to the service database and there is no per-user query history. A lookup record is held only in volatile server memory for up to 15 minutes so repeated identical searches can be answered quickly, and it disappears on restart. A search sends the entered domain or address to the third-party public record services listed above; those services have their own logging and retention practices. Domain lookups additionally query a second public certificate feed, public subdomain feeds, a public web crawl index and a public web archive of historical pages; address lookups query a public routing registry. All of these are third-party services — no query ever sends traffic to the researched target.

A bounded direct observation is available only for targets inside the requesting account's own verified scope: single connection attempts to a short list of common service ports, one HTTP(S) request for status and title, and a TLS certificate read when a web port answers. Tohou never sends probes from its infrastructure to a target the requester has not verified ownership of; every other Index lookup is answered from third-party public records alone. The operator can disable live observation entirely with the INDEX_LIVE environment flag.

Screenshots are captured by loading your verified web service in an isolated headless browser session, exactly as a visitor would. Only the latest screenshot per host is stored, it is visible only to workspace members through an authenticated route, and it is deleted together with the asset.

Index API requests are authenticated with hashed key secrets, counted against the account's daily lookup budget, and never stored as query history beyond the same volatile cache described for the Index.

Brand monitoring sends a verified domain label in a query to a public certificate-transparency service and stores potential certificate name matches inside the requesting workspace; these matches are leads for review, not a conclusion that a site is malicious.

If a workspace administrator enables credential-exposure monitoring for a verified domain, Sonar matches that domain against a public catalog of known breach records and stores only aggregate information in the workspace: breach names, dates, affected-account counts and exposed data categories. No credentials are ever requested, fetched or stored, and no administrator-provided keys are involved.

AI assistance

When you request a finding explanation, Sonar sends that finding's title, severity, evidence, remediation text and hostname to the DeepSeek API (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) for processing. DeepSeek states that API data is processed and stored in mainland China and retained under its own policy. Do not include secrets or personal data in target names, evidence or comments. Requests are made only when a workspace member explicitly asks for an explanation. See the DeepSeek Privacy Policy and Open Platform Terms.

Cookies and local storage

Sonar uses an essential session cookie lasting up to 30 days, shared across the Tohou subdomains you are signed in to (console and index), plus a short-lived OAuth state cookie. Theme preference is saved in local storage. The application does not include advertising trackers or nonessential analytics cookies.

Retention

Current asset state and findings remain while the workspace exists. Changed observations are retained for up to 90 days, with at most 30 historical states per asset. Notifications and completed scan records are retained for 30 days. Screenshots are latest-only per host and removed with the asset. Posture score snapshots are daily aggregates retained while the workspace exists. Cleanup requires an operational worker.

Deletion and exports

You can export workspace findings as CSV or export assets and findings as JSON. Account deletion is scheduled for 24 hours after confirmation. At the deadline, the worker removes the account and all owned workspaces; downtime can delay execution. Personal comments are removed during account purging. Other organizations retain their own asset and finding data. Copies you or recipients export to external systems are outside Sonar's control.

Infrastructure snapshots and independent operator backups may retain data separately. The operator must disclose any backup retention before enabling backups for customer data and must prevent restoration from reversing completed deletion requests.

Your choices

You can revoke API keys, remove webhooks, manage workspace access and request account deletion. Contact [email protected] to request access, correction, or information about processing and any rights available under applicable law.