Privacy and data use.
This page explains the data flows implemented by SSLConf's current public tools. It is an operational notice, not a substitute for legal advice tailored to a future account, payment, analytics or marketing feature.
Last updated: 20 October 2026.
Data you provide
Public diagnostic tools receive the hostname, optional supported port and language selection needed to perform the requested check. SSLConf connects only to public endpoints accepted by its validation controls.
Certificate and CSR decoders receive the PEM or DER material you paste. The Certificate & Key Matcher receives both the certificate and private key supplied for the comparison. Only submit material you are authorised to provide; do not use the matcher for production keys that you cannot safely disclose to this service.
How sensitive material is handled
Decoder and certificate-key matching requests are processed in memory. Their responses use no-store and the application telemetry records request metadata, not pasted certificate, CSR or private-key content. The matcher response is not cached.
The CSR Generator is different: it generates the private key and CSR in the browser with Web Crypto. The private key is not sent to an SSLConf API. Download and protect it before leaving the page; SSLConf cannot recover it.
Technical logs, rate limits and short-lived cache
For reliability and abuse prevention, application logs can include a request ID, selected tool, hostname and port, response status, duration, cache state and a one-way shortened hash of the client network address. The application does not log pasted PEM, CSR or private-key content.
Some public endpoint checks are held in an in-memory cache for a short period, normally five or ten minutes depending on the tool, to limit repeat connections. This cache is capacity-limited and is not a user profile. Deployment and hosting providers can process operational logs under their own service terms; this page does not define their retention periods.
Browser storage and third parties
SSLConf stores the sslconf_locale cookie for up to one year to remember the language. After successful server tests, the browser can keep up to six recent hostnames in localStorage under sslconf_recent_scan_hosts. You can remove both through your browser settings or the relevant tool control.
The current application code does not include user accounts, advertising tags or a third-party analytics SDK. If that changes, this notice must be revised before the feature is enabled.
Questions and changes
For a security report, use the published security contact. For questions about this operational notice, contact contacto@sslconf.com. Material changes to these data flows will be reflected here with a new update date.