Last updated: September 22, 2026. This policy is provided in English only.
Artfical Security Intelligence (referred to as "ASI," "we," "us," or "our") is operated by Artfical DT. ASI provides free public access to a searchable database of Common Vulnerabilities and Exposures (CVE) records, a database of known malware samples, security advisories describing vulnerabilities discovered by Artfical DT researchers, and a public build and bug history for open source software projects. This Privacy Policy explains what information we collect when you use our websites, located at db.artfical.com, submit.artfical.com, and asi.artfical.com (together, the "Services"), why we collect it, how we use it, and the choices available to you. By using the Services, you agree to the practices described in this policy. If you do not agree with this policy, please do not use the Services.
We built the Services to require as little personal information as possible. Most of what is on the Services, including the CVE database, the malware database, security advisories, and build history, is published data that requires no account, no registration, and no login of any kind to view.
2.1 Information collected automatically. When you visit the Services, our infrastructure and our content delivery provider, Cloudflare, automatically process your IP address and standard HTTP request information, such as your browser's user agent string, the page requested, and the time of the request, in order to deliver the page to you and to protect the Services against abuse. We use your IP address for one additional, limited purpose: to guess which language to show you by default, by sending your IP address to a third party geolocation lookup service, ip-api.com, which returns only a two letter country code. We do not store your IP address ourselves beyond what is needed to serve the request, and we do not build any profile tied to your IP address. You can always override the automatically detected language using the language selector at the top of every page, which sets the displayed language through a URL parameter rather than a cookie.
2.2 Information you choose to submit. The submit.artfical.com portal lets anyone report a file they believe is malicious. That page is deliberately designed so that the file itself is never uploaded to our servers: your browser computes the file's SHA256, SHA1, and MD5 hashes locally, and only those hash values, together with whatever text you choose to type into the name, description, platform, and tag fields, are sent to us. If you type personal information into those free text fields, for example your own name or contact details, that information will be stored and will be publicly visible on the corresponding malware database entry, because the entire point of the page is to publish threat intelligence. Please do not include personal information you do not want published.
2.3 Information we do not collect. We do not require or support user accounts. We do not ask for your name, email address, or payment information anywhere on the Services. We do not use cookies, browser local storage, or any similar tracking technology, and we do not run any third party analytics or advertising scripts. Section 6 explains this in more detail.
We use the limited information described above only to operate, maintain, and secure the Services; to select a default display language for you; to populate the public malware database with community-submitted hash reports; and to diagnose technical problems and prevent abuse of the submission form, for example through basic rate limiting. We do not sell personal information, and we do not use any information collected through the Services for advertising or marketing purposes.
For users in the European Economic Area, the United Kingdom, and Switzerland, where the General Data Protection Regulation (GDPR) or the UK GDPR applies, we rely on the following legal bases: our legitimate interest in operating a secure, reliable, and appropriately localized service, for the automatic processing of your IP address and request metadata described in Section 2.1, and your voluntary act of submission, for the community malware report data described in Section 2.2, which you provide knowing that it will be published as part of a public threat intelligence database. You have the right to object to processing based on legitimate interest; see Section 8.
We share limited information with the following categories of service providers, each of which processes it under its own privacy policy. Cloudflare, Inc. provides content delivery, DDoS protection, and TLS termination for all of our domains, and processes connection metadata including your IP address as part of that service. ip-api.com receives your IP address for the sole purpose of returning a country code used to pick a default display language. VirusTotal, operated by Google, may be contacted directly by your own browser if you use the optional "check VirusTotal" feature on the submission portal; that lookup is performed by your browser, not by our servers, and is governed by VirusTotal's own privacy policy. We also import and republish data that is already public, including CVE records from the U.S. National Vulnerability Database (NVD), operated by NIST, and malware indicator data from abuse.ch MalwareBazaar. That imported data is not personal information about you; it concerns known software vulnerabilities and malicious files.
As of the date of this policy, the Services do not set any cookies, do not use browser local storage or session storage for tracking, and do not embed any third party analytics, advertising, or social media tracking scripts. Because we do not use non-essential cookies or similar tracking technology, we do not display a cookie consent banner: under the ePrivacy Directive and equivalent laws, consent banners are required for non-essential cookies, and we simply do not set any. If this ever changes, for example if we introduce an optional feature that requires local storage or a cookie, we will update this section first and, where the law requires it, ask for your consent before doing so.
Automatically processed request metadata, such as IP addresses handled by Cloudflare for the purpose of delivering a page, is retained only as long as necessary for security and operational logging, in line with Cloudflare's own retention practices, and is not retained by us separately. Community-submitted malware report data (Section 2.2) is retained indefinitely as part of the public malware database, because it constitutes the historical threat intelligence record that the page exists to build. You may request removal as described in Section 8.
Depending on where you live, you may have rights to access, correct, delete, or export personal information we hold about you, and to object to or restrict certain processing. Because the Services do not have user accounts, most of these rights concern the free text you may have submitted through the submission portal. To exercise any of these rights, including asking us to remove a community-submitted entry, contact us using the details in Section 13. We will respond within a reasonable time and in any event within the time limits set by applicable law.
We take reasonable technical measures to protect the limited information we process, including serving all Services exclusively over encrypted HTTPS connections, running the submission form behind rate limiting and format validation to reduce abuse, and escaping user-submitted content before it is displayed in order to reduce the risk of malicious code being injected into pages. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security.
The Services are technical, security-oriented resources intended for security researchers, system administrators, and software developers. They are not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has submitted personal information to us, contact us and we will remove it.
Our infrastructure and service providers, including Cloudflare, operate data centers in multiple countries. As a result, information may be processed in a country other than the one in which you are located, including countries that may not have data protection laws equivalent to those of your home country. Where required by law, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.
We may update this Privacy Policy from time to time to reflect changes in the Services or in applicable law. We will post the updated version on this page and update the "Last updated" date above. If a change is significant, we will make reasonable efforts to highlight it on the site.
If you have questions about this Privacy Policy, want to exercise a data protection right, or want to request the removal of a community-submitted malware database entry, contact us at [email protected].