Last updated: 24 October 2026 (members' area, self-service account deletion)
Security Hub (securityhubtech.com) is an independent, educational cybersecurity website run by Mehdi Azrabi. This page explains what we collect when you use the site, why, who else is involved, how long we keep it, and what you can ask us to do. Questions: mehdi.azrabi@securityhubtech.com.
Most of Security Hub is for signed-in members. Without an account you can open only the home page, the Network toolbox, the Contact page and this page. Everything else (Cybersecurity, Cryptography, Dark Web, IPS/IDS and Snort, the AI guides, the Developer API docs, the two-factor and SAML guides, and the Community chat) needs you to sign in as a member.
So most of this page is about what happens once you sign in as a member: your account, what you do on the members' pages, the chat, and your choices, including deleting your account yourself. A few basics, marked everyone below, apply to every visitor, signed in or not, because they keep the website running and secure.
| When | What | Why |
|---|---|---|
| Every visit everyone | Your IP address, the approximate location worked out from it (country and city), your browser and device type (user agent), the pages you open and when. | To keep the site secure and to see how it is used (anonymous statistics). |
| Network security everyone | Our intrusion prevention system (Snort) inspects traffic to the website. When traffic matches a security rule, it records the source IP address, ports, the rule and the time. | To detect and block attacks. |
| Your member account members | Username, email address, your password (stored only as a secure hash), an optional profile photo, two-factor sign-in settings, API keys you create and a log of your API calls (time, endpoint, result and IP address), and sign-in attempts (time, IP address, success or failure). | To run your account, approve members and protect accounts from break-in attempts. |
| Members' pages and tools members | While you are signed in, the pages you open are linked to your account in the visit history. Text you paste into tools (for example certificates and CSRs in the Cryptography toolbox, or addresses in the Network toolbox) is processed to show you the result and is not stored. | To run the members' area and keep it secure. |
| Developer API members | The API is for members only: every call needs your personal API key. For each call we log the time, the endpoint, the result, how long it took and the IP address it came from. What you send to the tools is processed and not stored. | To run the API, apply rate limits and stop abuse. |
| Community chat members | Your messages and, in the private group, photos you share; with each message we keep the IP address and approximate location it was sent from. | To run the chat and to moderate abuse. |
| Contact form everyone | Your name, email address, subject and message. | To reply to you. |
We do not sell personal information, we do not use advertising or tracking networks, and we do not build profiles of visitors.
Some features rely on outside services. When your browser loads them, those services see your IP address (as with any website):
To describe an IP address (for your own connection on the home page, and for our security work) our server asks Team Cymru (which network an address belongs to) and the regional internet registries through rdap.org (who the address range is registered to). These services receive the IP address only, never your name or account. Locations come from a database file stored on our own server; IP geolocation by DB-IP (CC BY 4.0).
| Cookie | Purpose | Lasts |
|---|---|---|
sessionid, admin_sessionid | Keep you signed in (site and admin area) | Until you sign out, or 2 weeks |
csrftoken | Protects forms against cross-site request forgery | 1 year |
sh_vid | A random ID so a returning visitor is counted once in our statistics (not linked to your identity unless you sign in) | 1 year |
sh_2fa_trust | Only if you tick “trust this browser” at two-factor sign-in | 30 days |
All cookies are first-party, sent only over HTTPS, and none are used for advertising.
| Data | Kept for |
|---|---|
| Visit history (IP, location, browser, pages) | 30 days |
| Security (IPS) alerts | 30 days |
| API call log (members with API keys) | 30 days |
| Web server logs | 14 days |
| Community chat messages | 90 days |
| Contact form messages | 12 months, then deleted automatically |
| Accounts and their settings | Until you delete your account (you can do this yourself at any time) or ask us to |
| Backups of the above | 14 days, then overwritten |
The site is served only over HTTPS (with HSTS), passwords are stored as one-way hashes, two-factor sign-in is available for every account, sign-in attempts are rate-limited, and traffic is inspected by an inline intrusion prevention system. Data is stored on our own servers in New Zealand.
Delete your account yourself. Signed-in members can go to My profile → Delete my account at any time. After you confirm with your password, this straight away and permanently deletes your account (username, email address, password), profile photo, two-factor sign-in settings, API keys and their usage log, your Community chat messages and shared photos, your private-group membership and join requests, and the visit and sign-in history linked to your account. Copies in our backups are overwritten within 14 days. Messages sent through the contact form are not linked to accounts; ask us if you want them deleted too. Staff accounts are removed by the site owner.
You can also ask us to show you, correct or delete the personal information we hold about you (including your account and chat messages), or object to how we use it, by emailing mehdi.azrabi@securityhubtech.com. We will answer within 30 days. You can also block cookies in your browser (signing in will then not work), and a VPN hides your real IP address and location from every website.
We handle personal information under the New Zealand Privacy Act 2020. If you are in the European Union or the European Economic Area, you also have your rights under the GDPR: access, correction, deletion, restriction, portability and objection; our lawful basis is our legitimate interest in running and securing the site, and your consent or our contract with you for accounts, chat and the contact form.
If you are not happy with our answer, you can complain to the Office of the Privacy Commissioner (New Zealand), or, in the EU/EEA, to your local data protection authority.
If we change how we handle personal information, we will update this page and the date at the top.