Privacy Policy

Effective 1 January 2026

What Intellirity collects, what it never does with it, and how to exercise your rights.

What we collect

Account data: your name, work email, and — if you use organizations — your organization membership, role, and the models, policy packs and escrow holds your organization owns.

Product telemetry: which detection engine ran, its verdict, its risk score, the latency of the check, and any error. These are the fields a verdict needs in order to be explainable.

Scan payloads: prompts, code and agent actions you submit are processed to produce a verdict. They are not retained after the verdict is returned unless your plan explicitly configures an audit retention window.

What we never do

We do not train models on your traffic. Your scan payloads are not used to improve any model, ours or a third party's.

We do not sell your data, and we do not share it with third parties except the subprocessors listed below, each bound by a data-processing agreement.

We do not run background scans of your systems without an explicit instruction from you.

Subprocessors

Neon (managed PostgreSQL) — verdict and account storage. Your data is encrypted in transit and at rest.

Cloudflare (Turnstile) — spam protection on the public contact form. Turnstile sees the form submission and the request IP, nothing from your scans.

Vercel (application hosting) — serves the console and the API.

Clerk (identity) — sign-in, sessions and organization membership. Clerk processes account identity data under its own privacy terms.

Your chosen model gateway (for example OpenCode Zen) — only when you configure the reasoning endpoint or the reverse proxy. Prompts you send through the proxy are sent to that gateway by design.

The demo feed

An empty workspace shows synthetic activity so the console is not blank. Those rows are marked as demo traffic by the API and are excluded from your security score and your detection counts. Only findings produced from your own scans are counted as detections.

Your rights

You can access, correct, export and delete your data at any time, or ask us to, by writing to privacy@intellirity.com. If you are in the EU/EEA, you have the rights of access, rectification, erasure, restriction, portability and objection, and you may lodge a complaint with your supervisory authority.

Retention

Account data is retained while your account is active and for 30 days after closure. Verdict metadata and audit records follow the retention window configured for your workspace. Backups are retained for 35 days and then deleted.