Privacy Policy

Who this notice is from

PostQure operates this public website and the PostQure console described here.

All privacy requests, including UK GDPR rights requests, should be sent through the launch enquiry form on the homepage.

Public marketing origins: https://postqure.com and https://www.postqure.com. The authenticated console is a separate application at https://app.postqure.com.

Whose information this notice covers

This notice covers visitors to the public marketing site, people who submit the launch enquiry form, and users who sign in to the console.

It does not claim that PostQure reads customer secrets, private keys, source-code contents beyond an authorised collector, or unrelated estate data. Collectors operate only inside an explicit authorised scope. The public website does not launch assessments.

Information collected through the marketing site

Browsing the public pages does not require an account. The marketing application does not write first-party cookies or sessionStorage. After a visitor accepts the cookie notice or saves preferences, the site writes one first-party localStorage key, postqure.cookie-consent, so the notice does not keep appearing. That key records necessary acknowledgement and a marketing preference boolean. It does not load extra marketing pixels.

If you only read the pages and do not submit the form, PostQure receives the technical request data that HTTPS hosting produces (for example the page requested and standard connection metadata processed by Amazon CloudFront and S3). Those hosting logs are not used for advertising.

Launch enquiries

The launch form collects name, work email, organisation, optional role, optional estate-scope and priority selections, and a free-text message. Scope and priority, if chosen, are appended to the message before it is sent.

A hidden website field is a honeypot. If it is filled, the browser does not send the enquiry.

You must tick a consent box before the form will send. The box states that PostQure may store the details to respond to that launch briefing and will use them only to reply to that enquiry.

• name
• work_email
• company
• job_title, if provided
• message, including any selected scope and priority text
• consent = true

What happens after you send an enquiry

The browser posts JSON to a launch-enquiry HTTP API. There is no public read or list API for enquiries.

The server stores a record with an enquiry identifier, a created timestamp, the submitted fields listed above, a source label, and status “new”. The Cloudflare Turnstile token is checked and is not written into that stored record.

If storage succeeds, an email notification is sent to an operator mailbox that is not published on this website. That notification includes the enquiry identifier, timestamp, name, work email, organisation, role and message.

Application logs written by the enquiry handler are limited to enquiry identifier, HTTP status code, error class and request identifier. Those logs do not include the submitted name, email, organisation or message.

DynamoDB is the authoritative store. Enquiry records are kept so PostQure can reply and keep an internal record of the request.

Account and authentication data

The console at https://app.postqure.com uses Amazon Cognito with OAuth 2.0 authorization-code flow and PKCE. The published scopes are openid, email and profile.

The console can therefore receive an email address and basic profile claims that Cognito returns for the signed-in user, plus organisation context from the control-plane API (`GET /v1/me` and `GET /v1/organisations/current` in the current console contract).

Sign-in state is kept in sessionStorage under oidc-client-ts keys. A `postqure.signedOut` sessionStorage flag records an explicit sign-out. The marketing site does not share that storage.

The current console does not launch assessments from the browser. Later assessment features, if enabled, would process only assets a customer submits or authorises.

Technical and security logs

Enquiry-handler logs are limited to enquiry identifier, status code, error class and request identifier.

Amazon CloudFront, API Gateway, Lambda and Cognito produce service logs as part of hosting and authentication.

Assessment metadata

PostQure is built to discover cryptographic dependencies, inventory TLS certificates, verify quantum-vulnerable cryptography exposure and turn evidence into migration priorities.

Assessments are intended to run against assets the customer owns or has written authority to assess, inside an authorised scope. The product is described as using read-only assessment tools without customer-code execution, shell access or autonomous cloud mutation.

This notice does not claim that PostQure reads private keys, secrets platforms beyond an authorised connector, or systems outside the customer’s authorised scope.

Purposes and lawful bases

Responding to a launch enquiry: the form asks for consent to store the details and reply to that enquiry.

Operating the website and protecting the enquiry API: legitimate interests in delivering the pages you requested and reducing automated abuse, including Cloudflare Turnstile verification.

Console accounts: performance of a contract (or steps requested before a contract) with the organisation that asked for console access, and legitimate interests in securing that access.

Legal obligation: retaining information where UK law requires it.

Processors and international transfers

The following providers are used by the public website, enquiry path and console. No analytics, advertising or marketing-automation processors are present on the marketing site.

• Amazon Web Services — S3 and CloudFront for the static website; API Gateway, Lambda, DynamoDB and SNS for launch enquiries; Cognito for console sign-in. Enquiry infrastructure is documented for eu-west-2. ACM certificates for CloudFront are created in us-east-1.
• Cloudflare — Turnstile bot check for the launch form (`challenges.cloudflare.com`).
• Microsoft 365 — the published enquiry mailbox receives SNS notification email. Mail DNS for postqure.com is Microsoft 365.

Where processing happens

PostQure is operated from the United Kingdom. AWS processing for the enquiry path is documented in eu-west-2 (London). CloudFront, Cloudflare Turnstile and Microsoft 365 are distributed services, so information may be processed outside the UK.

Retention

Enquiry records are kept so PostQure can reply and keep an internal record of the request. They are deleted or anonymised when they are no longer needed for that purpose, unless UK law requires them to be held longer.

Console sessionStorage is cleared when the tab is closed or the console signs the user out. Cognito account lifetime follows the organisation’s console access.

Security safeguards

The public site is a statically exported Next.js app served over HTTPS with HSTS, a restrictive referrer policy, frame denial and a permissions policy that disables camera, microphone, geolocation and payment prompts.

Launch enquiries require schema checks, a consent tick, a honeypot, a request-size limit, Cloudflare Turnstile verification, restricted CORS and low API throttling. Public error bodies are generic. Successful responses use Cache-Control: no-store.

These measures reduce risk. They are not a guarantee that information cannot be lost, altered or accessed without authorisation.

Your UK GDPR rights

If UK GDPR applies to you, you may ask for access to your personal information, correction, erasure, restriction, objection, and portability where that right applies. You may also withdraw consent for an enquiry, which will not affect processing already completed in order to receive and store that enquiry.

To exercise a right, use the launch enquiry form, name the address the request concerns, and describe what you want. PostQure may need to check your identity before acting.

These rights are not absolute. A request may be refused where UK law allows it. If that happens, PostQure will explain why.

Complaints to the ICO

You can complain to the Information Commissioner’s Office if you are unhappy with how personal information has been handled. The ICO is the UK supervisory authority: https://ico.org.uk/make-a-complaint.

PostQure would rather resolve a concern directly first. Use the launch enquiry form before escalating a complaint.

Children

PostQure is a B2B cybersecurity product. The website and console are not directed at children. PostQure does not knowingly collect personal information from anyone under 18 through the launch form or console.

Changes to this notice

This notice was last updated on 26 August 2026. Material changes will be published on this page with a new date. Continued use of the website after a change is not treated as a substitute for a new consent where consent is required.