Privacy Policy

The Am I Secure? for Work app collects only the minimum information necessary to perform the security analysis that the user or their organization (e.g. employer, school, etc.) is requesting, no more.  We do NOT sell any customer information or data and we do NOT use such information or data to enrich datasets that are sold, even in an anonymized capacity. Our entire business revolves around your security, not your information.

There are three usage scenarios for the app, each with a different level of information that is collected. At no time can the app directly access information on your device nor will it request permission to do so. This can be confirmed by reviewing the app's privacy permissions in iOS Settings which will show NO access to your address book, photos, GPS/location, microphone, camera, etc. 

Scenario A: using the app without signing in and no account created by your organization

• No data collected at all

• This would be the "I downloaded the app and opened it but cannot get past the sign in screen" scenario.

Scenario B: using the app + signing in

• Accounts for the government & enterprise version are created by Numbers Station Inc. as requested by your organization (e.g. employer, school, etc.). Your organization shares with Numbers Station Inc. a list of email addresses and names to create accounts for.  It is up to your organization what information is shared, i.e. full name, first name and last initial, your normal email address, a specially created aliased email address that is just a random number, etc. This will depend on the privacy and security requirements of each organization. 

• We store in Firebase Authentication (see below) the email address and name provided. Firebase Authentication may temporarily retain the IP address of the device that connects to it for security purposes.

• The name and email address provided will NOT be sold, it will also NOT be shared with external parties except for as required by law (i.e. the highly unlikely situation where we are presented with a valid warrant by Canadian law enforcement or a court order to provide such information).

  • • Firebase may also provide this data if required by a warrant or court order.

• You cannot delete your account directly, only your organization can request the account be deleted. When an account is deleted, the name and email address provided will be deleted. They may continue to exist for a few days in Firebase systems but will be inaccessible to Numbers Station Inc.

• Mobile device security policy compliance checks sent to your organization, typically once per day, will include:

  • • Is the user on the latest version for iOS, the latest version of iOS for their device

    • Device model (i.e. iPhone 15 Pro Max)

    • Is Lockdown Mode enabled

    • Is iCloud Private Relay enabled

    • Is lockscreen/passcode enabled (but NOT the passcode itself, which the app does not have access to)

    • Is the device "jailbroken"

    • Is there a keylogger/3rd party keyboard installed

    • If there has been a recent advanced security scan performed

    • The IP address of the device at the time the check was submitted

• No other data collected.

Scenario C: using the app + signing in + submitting diagnostic data for advanced security scanning

• Includes the above from scenario B plus...

• We only have access to the diagnostic data you specifically select and share with the app. The app is unable to access any other data. Diagnostic data can be retained for up to six months if determined to be non-malicious during the initial scan, this is to allow for future scanning of old submissions as new threats are identified.  Diagnostic data deemed by Numbers Station Inc. to indicate that the submitters device is compromised with malware or spyware may be retained for up to 24 months. When diagnostic data is stored, the IP address of the submitting device at the time of submission is also retained with it by Numbers Station Inc. for the same time period as the diagnostic data itself. The IP address is used to determine trends if a compromise is detected, specifically which country the compromised device was in and what network it was on at the time of submission. The IP address is NOT combined with other data nor used to track nor locate the user in a more prescise way.

  • • Note: your organization controls account creation and deletion as well as the deletion and retention policy for diagnostic data. Typically the agreement between your organization and Numbers Station Inc. will be to retain data as indicated above, even if an individual account is deleted. If all accounts are deleted for an organization, then all diagnostic data is typically deleted immediately but this is dependant on each organization's agreement with Numbers Station Inc.

• Diagnostic data shared with the app may contain information about Wi-Fi networks that the device has connected to, such as the SSID or name of the network. Shared diagnostic data should NOT contain any personal content or personal information such as photos, messages, email addresses, etc. If during manual security analysis any such content is discovered, it will be scrubbed from our systems immediately. It is possible in some cases to utilize Wi-Fi network information to also geolocate where a device was in the past but we do NOT use the data in this way.

• No diagnostic data is ever shared directly with your organization. All that is shared is the result, was there a compromise or not.

• Shared diagnostic data transits through a third party, Firebase (see below), on their way to our analyzer and storage servers but is end-to-end encrypted with an encryption key that is only stored on our analyzer servers so that only we can access or read the submissions. Unencrypted submissions do not leave servers owned and controlled by Numbers Station Inc. Firebase does NOT have any access to or ability to read your diagnostic data.

• If your device is assessed as being compromised, your organization will be notified, potentially before you are. This notification will include the name and email address provided during account creation, the time that the diagnostic data was created, the time that it was submitted and the time when it was assessed as indicating a compromise occurred.

• Other than your organization, no external party will be notified or provided any personally identifying information of the compromised user. In jurisdictions where disclosure of a compromise to government or other organizations is legally required, the user or their organization must perform the required disclosure, Numbers Station Inc. does not perform such disclosure on behalf of the user or their organization.

• Numbers Station Inc. does not control nor it is responsible for any disclosures your organization may make concerning the compromise of your device, including their release of your name.

Firebase (our 3rd party cloud services provider)

The IP addresses of devices running our app that connect to Firebase may be retained temporarily by Firebase for security purposes.

Our app and servers use the following Firebase products:

Authentication: used to handle part of the Sign in with Apple authentication flow and to store usernames and email addresses and the associated Am I Secure? user ID.

Firestore: a database used to provide information to the app running on your device, such as the latest version of iOS available, security news articles and test results for submitted system diagnose files.

Cloud Storage: storage where end-to-end encrypted system diagnostic data that is submitted for advanced security scanning is temporarily stored until it is downloaded by our analyzer servers at which point it is deleted fom Firebase. At no point is Firebase able to read this data due to the end-to-end encryption.

App Check: a service that uses Apple's App Attest APIs to verify that the version of the Am I Secure? app running on your device has not been modified.  Attestation material does not contain any user identifiable information or content and is not retained.

Note that we do *NOT* use other Firebase products such as Firebase Analytics, Crashlytics, Performance Monitoring, etc. in our product to ensure maximum user privacy.