Security and data handling

Where it runs, what we receive and who helps us process it.

  • Where it runs

    Servers and database in Denmark (EU). Cloudflare delivers the site and absorbs attacks at the edge.

  • What a visitor check sends

    The visitor's IP address, user agent and a few browser headers. Never the page, cookies or form contents.

  • How long we keep it

    Request logs for 365 days, bot signals for 30 days, then deleted automatically. Email checks keep the domain, never the address.

  • On the wire

    TLS 1.2 or newer and HSTS on every page and API call. Our apps reach the database over a private network.

  • Your account

    Passwords are stored as bcrypt hashes. You can also sign in with Google or GitHub.

  • Who runs it

    Minori LLC, a US company. Questions go to contact@ipscanner.io.

Who processes data for us

The services we rely on, what they do and where.

ServiceWhat it doesWhere
CloudflareDelivers the site, DNS, attack protection, backups and file storageGlobal network
Hosting providerServers and databaseDenmark (EU)
StripePayments and invoicesUnited States
Mailjet, Amazon SESAccount and billing emailEU and United States
SentryError reports, with visitor addresses filtered outUnited States
GoogleSign-in, analytics and ad measurement, with consent where the law asks for itUnited States
Microsoft ClarityUsage analytics, with consent where the law asks for itUnited States
GitHubSign-inUnited States
Google GeminiLabels unknown networks from their name and number only, never visitor dataUnited States
Stadia MapsMap tiles on location resultsUnited States

What the verdicts are built on

Public lists on a schedule, plus our own checks.

  • Tor Project

    Tor exit nodes, refreshed every hour

  • Mullvad, NordVPN, Private Internet Access, IVPN, AirVPN, Windscribe

    VPN servers from each provider's own server list, refreshed weekly

  • X4BNet

    VPN and data center address ranges, refreshed every 6 hours

  • Apple iCloud Private Relay, Cloudflare WARP

    Privacy relay ranges, so a relay is never called a VPN

  • Google, Bing, OpenAI, Anthropic, Apple, Perplexity

    Published crawler address lists plus reverse DNS, to tell real crawlers from fakes

  • MaxMind GeoLite2

    Network owner (ASN) and location

  • TheSpeedX PROXY-List

    Open proxy lists, refreshed weekly

  • Google Gemini

    A label for networks no list knows, from the network's name and number only

This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com.

Report a security issue

Email contact@ipscanner.io with the steps to reproduce it. Please give us time to fix it before you publish.

Machine-readable contact: security.txt. How we handle personal data: privacy policy.

    Security and data handling | IPScanner