Privacy Policy

What We Collect

When you create an account, we collect your name, email address, and optionally your company name and job title. During assessments, the AI collects information about your IT infrastructure that you voluntarily share.

How AI Processing Works

Your infrastructure descriptions are sent to Anthropic's commercial API (Claude) for analysis. Per Anthropic's commercial terms:

• Your data is NOT used to train their AI models
• Data is retained for up to 30 days for trust and safety, then deleted
• Processing occurs in the United States

We strip personally identifiable information (your name, email, company) before sending infrastructure details to the AI. The AI only receives technical details about your environment.

Third-Party Services

• Anthropic -- AI processing (Claude)
• Voyage AI -- Text embeddings for provider matching
• Stripe -- Payment processing (we never store card numbers)
• Vercel -- Application hosting
• Turbopuffer -- Vector database for provider search

Data Retention

• Conversations and messages: retained while your account is active
• Audit logs: minimum 3 years (required for compliance certifications)
• Usage records: 2 years
• Archived conversations: auto-deleted after 2 years

Your Rights

• Export: Download all your data from Settings → Data → Export
• Deletion: Request account deletion from Settings → Danger Zone. Data is soft-deleted for 30 days (recoverable), then permanently removed.
• Correction: Update your profile information in Settings

Compliance

Our platform is built with controls aligned to SOC 2 Type II, HIPAA, FERPA, CMMC Level 2, and ISO 27001. For regulated industries, we offer Data Processing Agreements (DPAs) and Business Associate Agreements (BAAs) for Enterprise customers.

Cookies

We use a single httpOnly session cookie for authentication. No tracking cookies, no analytics cookies, no third-party cookies.

Contact

For privacy questions or to request a DPA: [email protected]