What Signal does with your data, where it runs, and who to call if something goes wrong. If your procurement team has questions this page does not answer, email [email protected].
Signal runs on two Hetzner servers, both in Helsinki, Finland. All web traffic passes through Cloudflare, which proxies requests and terminates TLS before forwarding them to our servers over an encrypted origin connection — so Cloudflare (a US company) sees request contents in transit. Signal is a single shared service: there is no per-customer database or tenant isolation.
Threat intelligence in the shared graph is derived from public and community feeds (NVD, CISA KEV, OTX, MalwareBazaar, CIRCL, MITRE ATT&CK, and others). When you look up an indicator with Threat Check and it matches something already in the graph, we log the indicator, its type, the verdict, the time and a salted, day-scoped hash of your IP address (not the IP itself). Those logs feed the public "trending lookups" list, so a matched indicator you check can appear there. Lookups that match nothing, and free-text names, are not logged.
Some features send text to Anthropic's Claude API for processing: the assistant/agent chat, the Subtext analyser and the Niko graph assistant (your prompt and any indicators in it are sent), plus our own background jobs that extract facts from public feed articles, summarise actor activity and write the DEFCON and sitrep briefings. If you do not want text leaving our servers to Anthropic, do not use the chat, Subtext or Niko features.
Our public pages include a small first-party script that sends one request after you scroll, click, tap, press a key or keep the page open for five seconds. It carries the page path and hostname, so we can tell real visitors from automated traffic. It sets no cookie, stores nothing on your device and assigns you no ID. Like most websites, our servers log requests, including IP address and browser type, and we use those logs to estimate new and returning visits by network and browser type. Browsers sending Global Privacy Control do not send the script's request. On ninjalabz.io, if you subscribe to or dismiss the newsletter prompt, your browser remembers that choice locally. We use no third-party analytics or advertising trackers.
TLS between your browser and Cloudflare uses Cloudflare's certificates; Cloudflare-to-server traffic uses a Cloudflare origin certificate. Session-signing keys, database credentials and API keys are held only in server-side environment files, never in git. Signing keys are not currently rotated on a schedule.
Nightly backups are copied between our two Helsinki servers over an encrypted WireGuard tunnel and kept for 7 daily and 4 weekly copies. A further copy is kept by the founder in the UK; within it, secrets, database dumps and application data are encrypted (AES-256), while the graph database snapshot (derived largely from public threat feeds) is compressed but not separately encrypted. Web server access logs (IP address, path, user agent) are kept for up to two years for abuse and bot analysis. Threat Check lookup logs are capped at the most recent 20,000 entries. DEFCON mailing-list records (email, consent time, IP address, user agent) are kept while you are subscribed; sign-ups never confirmed are deleted after 30 days.
Ninja Signal is run by a single founder. There is no hot-standby copy of the service: if the server hosting Signal fails, the service is down until it is restored from the most recent nightly backup. Contractual continuity terms (such as escrow) can be discussed for enterprise agreements.
Hetzner (hosting, Finland). Cloudflare (DNS, proxy and TLS termination). Anthropic (AI processing as described above). Mailing-list email is sent from a self-hosted listmonk instance.
Report a suspected vulnerability or data incident to [email protected] (or [email protected]). Our disclosure details are in /.well-known/security.txt. As a single-founder company we do not publish a guaranteed response time; reports are handled by the founder directly.
We are UK-based and aim to meet UK GDPR. To ask for a copy or deletion of your data, email [email protected]. Mailing lists use double opt-in and every email has a one-click unsubscribe.
Last reviewed 2026-10-19. Earlier versions of this page are available on request.