Privacy Policy
What we collect, why we collect it, and who else touches it.
EFFECTIVE 20 SEPTEMBER 2026Scope
This policy covers coretraceus.com and the contact form on it. CoreTrace sells penetration testing to organisations; this site is aimed at businesses, not consumers, and is not intended for personal or household use.
Information we handle during an engagement — findings, evidence and reports belonging to a client — is not covered here. That is governed by the contract signed for that engagement, which sets confidentiality and handling obligations well beyond this notice.
Who we are
CoreTrace LLC
728 Edgemore Dr, Sun Prairie, WI 53590
contact@coretraceus.com
What we collect
Only what you choose to send us through the contact form on this site:
- First and last name
- Email address
- Company name
- The services you select
- Your message
We use no cookies, no analytics and no tracking of any kind — no advertising pixels, no session tracking, no behavioural profiling. Your browser is not asked to store anything.
One technical detail worth stating plainly: your IP address is processed by Cloudflare, which hosts this site, to filter malicious traffic and to run the anti-bot check on the contact form.
Why we use it
Solely to read and respond to your enquiry, and to discuss a possible engagement. We do not sell your information, share it for marketing, add you to a mailing list, or use it for automated decision-making or profiling.
Where it goes
By design, nothing you submit is stored on this website. There is no database and no saved copy — your message is delivered straight to our mailbox and exists only there. Three providers handle it on the way:
| Provider | What they do |
|---|---|
| Cloudflare | Hosting, security filtering and the anti-bot check on the form |
| Resend | Delivers the form submission to us as email |
| Microsoft 365 | The mailbox the message arrives in |
All three are US-based, as are we, and each is bound by its own data processing terms. We will update this list if it changes.
There is no fourth row. Fonts, stylesheets and scripts are served from this domain, so loading a page here does not hand your IP address to anyone else.
How long we keep it
Enquiries stay in our mailbox for up to 24 months after our last exchange, then are deleted. If we go on to work together, engagement records are kept for the period set out in the engagement contract and for as long as applicable law requires.
Your choices
Email contact@coretraceus.com and we will tell you what we hold about you, correct it, or delete it. We reply within 30 days.
How we protect it
This site is served only over HTTPS with HSTS, a content security policy, and clickjacking and MIME-sniffing protections applied to every response. The contact form is protected by an anti-bot check, and requests to paths the site does not serve are blocked at the network edge.
Your submission is not written to any database — there is no stored copy on this website to be breached. It exists as an email in our mailbox, which is protected by the access controls of our email provider.
We would rather be plain than reassuring: no control set makes a system impossible to compromise, and a firm that tests defences for a living should be the last to claim otherwise. What we can say is that we hold very little of your data, for a limited time, in one place.
Children
This site is intended for business use and is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has sent us information, email contact@coretraceus.com and we will delete it.
Changes to this policy
If our practices change we will update this page and move the effective date above. We do not make changes retroactively.