Effective September 6, 2026. DNA Technology, Toronto, Ontario, Canada.
This page covers the IAM X-ray website and the IAM X-ray licence service. Your DNA Technology account, the marketplace and payments are covered by theDNA Technology privacy policy. DNA Technology, Toronto, Ontario, Canada, is responsible for the information described here.
This site is static pages. It has no accounts, no forms, no analytics and no advertising, and it sets no cookies of its own. Two things happen when you load a page:
When you download the software, the request for the file is logged in the same way. We do not link downloads to people.
How often the app contacts us is your choice. In automatic delivery it contacts the licence service only for licensing: when you sign in, when you move or release a seat, and once per billing period to collect a fresh licence file. In manual delivery it makes no outbound connection at all, and you bring the licence file yourself. When it does contact us, the request carries some or all of:
| Item | What it is |
|---|---|
| Device digests | SHA-256 digests of the Windows machine identifier, the system volume serial number and the mainboard serial number. The raw values never leave your machine. We cannot turn a digest back into the value. |
| Hostname | The computer name, so you can recognise the device on your account page. |
| App version | The version of the software making the request. |
| Account id and email | The id of your DNA Technology account and the email address on it, carried in the signed grant the marketplace issues when you confirm the sign in code. |
| Activation id | A random identifier for the seat held by that device. |
| IP address | Seen by the service like any web request. It is used for rate limiting and stored only as a SHA-256 digest in the event log. |
When you run iamxray update, the app fetches the update manifest and the new build from this site, which is logged as in section 1.
The app does not send us anything it reads from your directories, tenants or hosts, or anything it derives from that: no user or group data, no findings, no reports, no snapshots, no dossiers, no automation audit records, no credentials. It has no usage telemetry and no crash reporting. In the trial and when signed out, apart from the sign in itself, it contacts nobody.
One optional feature contacts a third party: the breached password check sends the first five characters of each password hash to the Have I Been Pwned range service, which returns candidate matches without learning the full hash. It is off until you turn it on in your configuration.
To know how many devices hold seats on a licence and enforce that number, to let you see and release devices, to apply the trial and move rules, to stop abuse of the service, to answer support requests, and to keep a record of what happened to a licence and when. We do not use this information for advertising or profiling, and we do not sell it.
Some of these providers store data outside Canada, in particular in the United States. It is then subject to the laws of those places.
You can shorten this for your account by asking us to delete it (section 9), subject to records we must keep by law.
Device identifiers are hashed on your machine before they are sent. IP addresses are hashed before they are logged. Activation tokens are signed by us and stored on your device encrypted with Windows data protection. The licence database allows no direct client access; only our service code reads and writes it. Entitlement updates from the marketplace are authenticated with a signed partner API. No method is perfect; if we learn of a breach affecting your information we will tell you as the law requires.
DNA Technology follows the Personal Information Protection and Electronic Documents Act (PIPEDA). You may ask us:
Write to privacy@dnatechnology.ca. We answer within 30 days. If you are not satisfied with our answer you may complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, British Columbia or Alberta, your provincial law and commissioner may apply as well. If you live outside Canada you may have additional rights under your local law.
The software is for use by organisations and professionals. It is not directed at children and we do not knowingly collect information from anyone under 18.
We will update this page when the site or the licence service changes what it collects. The date at the top says when the current version took effect.
DNA Technology, Toronto, Ontario, Canada. Privacy: privacy@dnatechnology.ca.