1. Who operates Threat Registry
Threat Registry is operated from the United Kingdom. Primary service infrastructure is hosted in Germany within the European Economic Area. This policy intentionally identifies the service rather than publishing private personal contact details of individual operators.
2. Information we process
Depending on how you use Threat Registry, we may process account information, contact details, reports you submit, threat indicators, incident information, uploaded evidence, subscriptions, notification preferences, moderation and case-history records, Discord identifiers, integration configuration and technical or security logs.
3. Community reports
Reports may contain information supplied by a reporter about a suspected digital threat. Where a reporter chooses to make a report public, report content may appear in the community intelligence feed. Contact email addresses and privately uploaded evidence are not intended to be shown in that public feed.
4. Evidence
Evidence submitted with a report is handled as private case material for analyst review. Users should not upload passwords, authentication or session tokens, two-factor authentication codes, payment-card information, executable malware or unnecessary personal information.
5. Discord bot
When the Threat Registry Discord bot is installed or used, Threat Registry may process Discord user IDs, server IDs, channel IDs, role IDs, bot configuration, command interactions and other identifiers required to provide the requested integration.
The bot may deliver incident updates, alerts and other configured intelligence to Discord communities. Discord separately processes information under its own terms and privacy practices, and may process information in countries outside the United Kingdom or European Economic Area.
6. APIs and other integrations
Connected services may provide identifiers, configuration data or event information needed for an integration to function. Information received from third-party services is also subject to the privacy practices of those services.
7. Security and operational logs
Threat Registry may retain technical and security information such as request metadata, authentication activity, errors, audit events and service diagnostics where needed to operate, troubleshoot and protect the platform.
8. How information is used
Information may be used to operate accounts, investigate community reports, maintain incident records, provide subscriptions and notifications, moderate submissions, operate the Discord bot and integrations, prevent abuse, protect the service and improve Threat Registry.
9. Public intelligence records
Incident, alert, breach, indicator and threat records intentionally marked public may remain available as part of Threat Registry's historical intelligence record, including records later marked fixed or patched. Private evidence and account contact information are handled separately from public intelligence.
10. Where information is processed
Threat Registry is operated from the United Kingdom and primary infrastructure is hosted in Germany. Information submitted to the service may therefore be stored and processed on infrastructure located in Germany. Some third-party integrations, including Discord, may process information in additional countries.
11. Retention
Information is retained for as long as reasonably necessary for the purpose for which it was collected, including security, investigation, audit, abuse prevention and historical intelligence purposes. Records may be deleted, restricted or anonymised where appropriate.
12. Your choices
Account settings can be used to manage available notification and publication preferences. Where applicable, requests concerning access to, correction of or deletion of personal information may be considered subject to legal, security, abuse-prevention and legitimate record-keeping requirements.
13. Changes to this policy
This policy may be updated as Threat Registry and its integrations develop. The current version will be published on this page.