Legal
Last updated: October 2026
This Privacy Policy describes how Drubix ("we," "us," "our") collects, uses, and shares information through the Drubix website and the Drubix monitoring service (together, the "Service"). It applies to agencies and individuals who use the Service, and describes the data we collect about the Drupal sites submitted to it.
When you create an account or contact us, we collect information like your name, email address, and company name.
When you submit a site's URL, we collect publicly reachable information about it: the site's URL, detected Drupal core version, detected contrib module names (without needing credentials), HTTP response headers, and the presence of certain publicly exposed paths (used only to flag them as findings, not to access their contents).
If you install our optional Drupal module on a site, we additionally collect: exact installed module versions, PHP version, and configuration drift information (which configuration objects differ between the active and last-exported configuration), security settings, and, for accounts that can administer the site only, their username, user ID, account creation date, last login date and whether two-factor login is set up, and, once a day, the file paths (not contents) of core and contrib files that differ from the official drupal.org release or aren't part of it, and of any PHP files in the public files folder. We do not collect email addresses, passwords, other user accounts, the contents of your site's database, or content. This is more detailed than passive scanning and is only collected if you choose to install the Connector.
If you connect a site's GitHub repository, we read its Composer files to find exact package versions, and scan its first-party files (not third-party libraries) for committed secrets such as passwords and API keys and for common security mistakes in custom code. File contents are processed in memory and not stored; when a secret is found we store only its location and a masked preview (for example the first four characters), never the full value.
If you turn on Autopilot for a site, we also clone the pull request branch briefly to update composer.lock (the copy is deleted straight away), read your CI results, and merge pull requests on your behalf. If you set a preview URL, we store screenshots of a few public pages of the live site and of the preview so you can compare them. If you ask a client to approve updates, we store their email address and send them approval emails on your behalf.
Payment is processed by Paddle.com Market Ltd., our merchant of record. We do not collect or store your payment card details. Paddle handles this directly, under its own privacy policy.
Like most web services, our servers log standard technical data (IP address, browser type, pages visited, timestamps) for security and operational purposes.
We do not sell your data, and we do not use the site data we collect to train unrelated products or to advertise to you.
Our benchmarking feature compares a site's findings against an aggregate of other monitored sites. This only ever shows a percentile figure (e.g. "top 12%"). It never reveals which other sites contributed to that figure, and only computes a result at all once enough sites exist in the comparison set to keep any individual site from being identifiable.
We do not share your site data with other customers, and we do not sell data to third parties.
We retain account and site data for as long as your account is active, plus a reasonable period afterward for backups and legal/accounting purposes. You can request deletion of your account and associated data at any time (see Section 8).
[Placeholder: describe where data is actually hosted and, if customers or their end clients are in the EU/UK, what transfer mechanism applies (e.g. Standard Contractual Clauses) once confirmed with a lawyer and your actual hosting setup.]
Depending on where you're located, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. We extend these rights to all users regardless of location as a matter of practice, not only where legally required. To exercise any of these, contact us at hello@drubix.com.
If you submit a site you don't personally own (e.g. a client's site), you're responsible for ensuring you have the appropriate basis to have that site's data processed by Drubix under your agreement with that client. We process that data as instructed by you, the account holder. We don't have a direct relationship with your client and won't act on instructions from them regarding data we hold on your account.
We use reasonable technical and organizational measures to protect the data we hold, including encryption in transit and signed, verified communication for automated data submission (the Connector module and payment webhooks). No system is completely secure, and we can't guarantee absolute security.
We don't use advertising cookies. On the marketing website, we use Google Analytics and Microsoft Clarity only if you accept analytics cookies in our cookie banner; you can change your choice at any time via "Cookie settings" in the footer. The Drubix app uses browser storage only to keep you signed in. See our Cookie Policy for the full list and how to control them.
The Service is intended for business use and is not directed at individuals under 18. We don't knowingly collect personal data from children.
We may update this Privacy Policy from time to time. We'll post the updated version here with a new "Last updated" date.
Questions about this policy or your data: hello@drubix.com.