Privacy policy
Last updated: 15 October 2026.
This policy describes how the Tohou Sonar application handles account and workspace information. The current service operator and contact for privacy requests is Ichate, Switzerland: [email protected]. Tohou is not represented here as a registered legal entity.
Information processed
Discord sign-in supplies your Discord user ID and display name. Sonar requests identity access, not your email, server memberships or messages. We store workspace membership, submitted targets, verification challenges, scan results, findings, comments, API-key metadata and activity records. API secrets are stored as hashes. Saved Discord webhook URLs and authenticated test credentials are encrypted.
Purpose and sharing
We use this information to authenticate users, verify scope, provide scans and reports, enforce limits and investigate misuse. Workspace data is accessible to authorized workspace members and the operator responsible for maintaining the service. We do not sell workspace data or publish it in a global index.
Discord processes authentication and receives notification content when you configure a Discord or Slack incoming webhook. Certificate-transparency and brand-monitoring queries send domains or brand labels to crt.sh. Public Domain and IP Index lookups send the query to urlscan.io; IP lookups also query RIPEstat and reverse DNS. DNS resolvers and target systems receive the network queries needed for verification and scanning. Hosting and network providers process traffic and stored service data as part of operating the infrastructure.
When an administrator imports a CycloneDX software inventory for a verified asset, Sonar sends versioned package URLs to OSV.dev to check for known vulnerabilities. The uploaded document is processed in memory and is not retained; Sonar stores its digest, component count and resulting workspace findings. OSV.dev receives the package identifiers in each query.
ASN coverage requests send the ASN to the RouteViews public API and store the returned public BGP prefixes in the requesting workspace. These routes are passive observations, not proof of asset ownership. Written authorization submitted for operator review is encrypted at rest and accessible to the platform operator for that review. It is retained with the workspace authorization record and removed when the prefix or workspace is deleted. Company coverage labels and their links to already verified domains are workspace-private.
The Public Index stores hostnames returned by crt.sh public certificate transparency queries in a separate table without workspace, account, scope, scan or finding identifiers. This index is available to signed-in users and is retained for up to one year. A search sends its domain query to crt.sh; matching hostnames from that public source may be shared with other users through this index.
Public Index searches also query urlscan.io for existing public scan metadata and resolve public DNS records for matching hosts. Search domains and hostnames are sent to those providers or DNS resolvers as needed. The index may be used by other signed-in users because it contains public-source data only. Brand monitoring sends a verified domain label in a query to crt.sh and stores potential certificate name matches inside the requesting workspace; these matches are leads for review, not a conclusion that a site is malicious.
If a workspace administrator configures an XposedOrNot domain API key, Sonar sends that key to api.xposedornot.com for a breach summary tied to the provider-verified domain. The provider response can include email-level breach details; Sonar processes the response in memory, discards those details, and stores only aggregate breach names and counts in the workspace. The key is encrypted at rest and removed with the monitor. Review XposedOrNot's own privacy and API terms before enabling the integration.
AI assistance
When you request a finding explanation, Sonar sends that finding's title, severity, evidence, remediation text and hostname to the DeepSeek API (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) for processing. DeepSeek states that API data is processed and stored in mainland China and retained under its own policy. Do not include secrets or personal data in target names, evidence or comments. Requests are made only when a workspace member explicitly asks for an explanation. See the DeepSeek Privacy Policy and Open Platform Terms.
Cookies and local storage
Sonar uses an essential session cookie lasting up to seven days and a short-lived OAuth state cookie. Theme preference is saved in local storage. The application does not include advertising trackers or nonessential analytics cookies.
Retention
Current asset state and findings remain while the workspace exists. Changed observations are retained for up to 90 days, with at most 30 historical states per asset. Activity records are retained for 90 days. Notifications and completed scan records are retained for 30 days. Cleanup requires an operational worker.
Deletion and exports
You can export workspace findings as CSV or export assets and findings as JSON. Account deletion is scheduled for 24 hours after confirmation. At the deadline, the worker removes the account and all owned workspaces; downtime can delay execution. Personal comments and actor audit records are removed during account purging. Other organizations retain their own asset and finding data. Copies you or recipients export to external systems are outside Sonar's control.
Infrastructure snapshots and independent operator backups may retain data separately. The operator must disclose any backup retention before enabling backups for customer data and must prevent restoration from reversing completed deletion requests.
Your choices
You can revoke API keys, remove webhooks, manage workspace access and request account deletion. Contact [email protected] to request access, correction, or information about processing and any rights available under applicable law.