The short version
We built these tools to help you understand how email attacks work and where your organization is exposed. We collect the bare minimum we need to run the analysis, deliver the report you asked for, and prevent abuse. We do not sell your data. We do not train AI models on what you submit.
Why .org and not .com
Same team, different surfaces. StrongestLayer Inc. ships an email security product at strongestlayer.com. This site is where our threat research team publishes the taxonomies and tools the product is built around. We keep the two separate on purpose so the .org can be a place to share useful information without the instrumentation a sales site needs. No cookies, no behavioral analytics, no pixel-level heatmaps, no third-party tracking JavaScript. The only telemetry on this site is server-side and anonymous: aggregate counts of how many checks run, what risk tiers come back, how long pages take to load. Nothing tied to your identity. Nothing sold or shared.
The one third-party request this site makes is a stylesheet load from Google Fonts for the Inter typeface. That is a CSS request, not a tracking beacon, and is the standard way to serve web fonts on the open web. If you block third-party fonts, the site falls back to your system sans-serif and works the same.
What we collect
Information you provide directly
- Target domain. The website domain you ask us to analyze.
- Your work email. Where the report is delivered.
- Company name and your name (optional). Used to disambiguate the analysis and personalize the report.
Information we generate during analysis
- The completed report. Cached for 7 days per target domain so a re-request returns instantly without re-running the analysis.
- Analytics events. Anonymous, aggregate-only: how many runs per day, tier distribution, detected stack class, latency. Never tied to your email or person.
Information we do not collect
- We do not connect to your mail tenant, internal systems, or any private resource.
- We do not collect IP addresses beyond what Cloudflare retains for DDoS protection at the edge.
- We do not use cookies for advertising or analytics.
- We do not request or store passwords, payment info, or personal identifiers beyond your work email.
What we do with it
Run the analysis
Your inputs are passed to our analysis pipeline (Anthropic Claude with web search) which returns the Corporate Email Posture Check findings. Anthropic processes data per their privacy policy and does not train on API inputs by default.
Deliver the report
The report is rendered on the page and emailed to your work address from info@strongestlayer.org via Resend.
Quality control by our threat research team
Each generated report is shared internally with the StrongestLayer Threat Research team for quality control. Specifically: verifying that findings are accurate and properly cited, identifying patterns in attacker-relevant OSINT exposure across organizations, refining the Corporate PDA framework over time, and improving the assessment model. This review is internal to StrongestLayer staff under existing confidentiality obligations. Reports are never shared with third parties, never used as marketing material, and never used to train external AI models.
Prevent abuse
We rate-limit at one check per work email per 7 days. Free email providers (Gmail, Yahoo, Outlook, etc.) are blocked at submission. Multiple people from the same company can each run a check using their own work email.
What we do not do
- We do not sell your data. Ever.
- We do not train AI models on what you submit.
- We do not share your information with marketing partners or data brokers.
- We do not retain your input beyond what is needed for the analysis and abuse prevention.
Three commitments specific to the Corporate Email Posture Check
These are the three CISO-grade trust questions we hear most often about a free recon tool. We answer them up front so you do not have to ask.
1. Reputational: we do not publish findings about your organization
If we publish research that draws on aggregate Corporate Email Posture Check data, it uses aggregate trends only. Your organization is never named, your scores are never disclosed individually, and your specific findings are never used as marketing material, sales collateral, or quoted in case studies. The default is privacy; there is no opt-out form to fill in because you are already opted out.
2. Intelligence: we do not retain a record of who ran a check
The report itself is cached for 7 days keyed on the target domain so re-requests within that window return instantly without burning a fresh analysis. After 7 days the cache entry auto-purges. We do not keep a separate ledger of which domains have been checked, which emails ran which check, or how many times any given domain has been assessed. The fact that you ran this tool is not a piece of intelligence we hold beyond the cache window.
3. Competitive: we will not contact you about this report
We will not call you, email you, or reach out through your network about the report you ran here. The report is for your benefit, not ours. If you want to talk to us, the path is yours: the Contact Us button at the top of every page, or info@strongestlayer.org. We start no outbound conversation triggered by your Corporate Email Posture Check submission.
Retention
- Report cache: 7 days, keyed on target domain. Auto-purges.
- Rate-limit record: 7 days, keyed on the work email you submitted. Auto-purges.
- Resend email logs: Resend retains delivery metadata per their policy, typically 30 days.
- Analytics events: aggregate-only, retained according to Cloudflare Analytics Engine defaults.
Your rights
You can request deletion of any information tied to your work email by emailing info@strongestlayer.org. Cache entries auto-purge in 7 days regardless. If you are in the EU, UK, or California you have additional rights under GDPR, UK-GDPR, and CCPA respectively, including the right to access, correct, or delete your data and the right to lodge a complaint with a supervisory authority.
Contact
Questions about this policy: info@strongestlayer.org. Replies route via Cloudflare Email Routing to a real inbox we monitor.
Changes
We may update this policy. The Last Updated date at the top reflects the most recent change. Material changes will be communicated by updating the date and noting the change in our free tools hub.