Privacy Policy

1. Scope

This Privacy Policy explains how Cefense, Inc. ("Cefense", "we", "us") collects, uses, discloses, and protects information when you use cefense.com, the Cefense workspace, the cf command line interface, our APIs, and our agent interface (together, the "Service"). It is part of, and incorporated into, our Terms of Service.

It does not cover the practices of third parties we do not control, including your source control host, or any site the Service links to.

2. Our two roles

We handle two different kinds of information under two different roles, and it matters which one applies.

Account data: we are the controller

Names, emails, Organization details, billing records, and usage telemetry. We decide why and how this is processed, and this Policy describes it.

Customer Content: we are the processor

Your source code and everything derived from it. We process it on your instruction, for the purpose of running the Service for you, and for no other purpose. You remain the controller. Where you are subject to the GDPR or a similar law and personal data appears in your repositories, you are responsible for having a lawful basis for putting it there.

3. What we collect

Information you give us

• Account and identity. Your name, email address, and profile image, handled through our authentication provider. If you sign in with a third-party identity, we receive the identifiers that provider returns.
• Organization details. Organization name, seats, members, roles, and settings.
• Billing information. Billing contact, address, plan, term, and invoice history. Card details are collected and stored by our payment processor; we receive only a token, the last four digits, the brand, and the expiry.
• Support communications. Anything you send us by email, including what you attach to it.

Information from your code host

• Authorization credentials. Access and refresh tokens for your connected host, encrypted at rest.
• Repository metadata. Repository names, visibility, default branch, languages, collaborators, commit and branch state, and pull request metadata.
• Customer Content. Source code, dependency manifests, lockfiles, configuration, and anything else present in a connected repository at the revision being scanned. This is the substance of the Service and it is the most sensitive thing we hold.

Information the Service generates

• Output. Findings, file and line references, severities, intelligence matches and citations, proposed patches, software bills of materials, proofs, and reports.
• Usage telemetry. Scan records, model call counts, token counts by category, and the frozen cost of each, kept as an immutable ledger. This is what the Allowance meter reads and what an invoice is reconciled against.
• Logs. IP address, user agent, timestamps, request paths, and error traces, generated automatically when you use the Service.
• Website analytics. On our public website, the pages you visit, how you arrived, approximate location, and device and browser type, measured with Google Analytics where you have allowed it. See section 12.

4. How we use information

We send marketing email only if you opt in, and every marketing email carries an unsubscribe link. Service and billing notices are not marketing and you cannot unsubscribe from them while you hold an account.

Where the GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Service and billing), legitimate interests (security, abuse prevention, aggregate product improvement, and defending claims), consent (marketing email and non-essential cookies), and legal obligation (tax and accounting records).

5. Source code and AI processing

When the Service scans a repository, it selects the files that carry security surface, batches their contents together with a system prompt and an excerpt of relevant public research, and sends each batch to an artificial intelligence provider for analysis. Verification, patch generation, and classification work the same way. The providers we use for this are:

What this means in practice. Customer Content, including proprietary source code and anything embedded in it, is transmitted to and processed on infrastructure operated by companies established in the People's Republic of China and subject to the laws of that jurisdiction, including laws that may compel disclosure to state authorities. We cannot guarantee the confidentiality of Customer Content against a lawful demand made on a provider under a foreign legal system. You should decide, for each repository, whether that risk is acceptable to you, and you should not connect a repository where it is not.

What we do to limit the exposure

• Only files that survive the security prefilter are transmitted, not the whole repository. A scan is capped at a bounded number of files.
• Transmission is over TLS.
• We send file contents and the metadata needed to analyze them. We do not send your account identity, your billing details, or your Organization membership to a model provider.
• We do not send Customer Content to any model provider other than those named above. Introducing another provider that receives Customer Content is a material change and we will give notice under section 14.

Training

We do not use Customer Content to train, fine-tune, evaluate, or otherwise improve any machine learning model, our own or a third party's. We use the model providers above for inference only, through their commercial APIs, and we rely on the data handling terms those providers publish. Those terms are set by them and can change. We are not able to audit a third-party provider's internal practices, and you should read this commitment as a description of our own conduct and our contractual position, not as a technical guarantee about a system we do not operate.

The Service does not make decisions producing legal or similarly significant effects about individuals through automated processing. Findings and proposed fixes are assessments about code, always subject to human review before they take effect.

6. Who else processes your data

We use the following subprocessors to operate the Service. Each is bound by contractual confidentiality and data protection obligations and may use the data only to provide its service to us.

This list is current as of October 21, 2026. We will update it here before a new subprocessor begins processing Customer Content, and we will give notice under section 14 where the change is material. To receive notice of subprocessor changes by email, write to support@email.cefense.com.

Other disclosures

• Within your Organization. Anyone holding a seat in your Organization may see its repositories, findings, and Output. Admitting a member is a disclosure decision you make.
• Legal process. We may disclose information where required by law, subpoena, or court order, or to establish or defend a legal claim. Where we are legally permitted to, we will notify the affected Organization first so it has an opportunity to object.
• Corporate transaction. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of it. The acquirer remains bound by this Policy, or you will be given notice and the ability to delete your data before any change of practice.
• With your direction. When you tell us to, for example by having the Service open a pull request on your host.

7. International transfers

We are based in the United States. Operating the Service involves transferring information across borders, including to India (where scan workloads may execute) and to the People's Republic of China (where the model providers in section 5 operate).

Where we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with the technical measures described in section 5.

8. We do not sell or share your information

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act as amended, or under the comparable laws of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, or any other United States state privacy law. We have not done so in the preceding twelve months. We do not use or disclose sensitive personal information for any purpose other than providing the Service.

We do not serve third-party advertising on the Service and we do not run advertising trackers on it.

9. How long we keep things

Deleting an Organization deletes its Customer Content and Output. We may retain aggregated or de-identified data that cannot reasonably be used to identify you or reconstruct your code, and we may retain what we are legally required to retain.

10. Security

• Traffic to and from the Service is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure providers.
• Code host tokens are encrypted at rest with a dedicated application key, separate from the database credentials.
• The scanner runs with a read-scoped database role, separate from the control plane, so a scan cannot write to your records.
• Access to production systems is restricted to personnel who need it, and is logged.
• Internal access to Customer Content is limited to what is necessary to operate the Service or to respond to a support request you have raised.

No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your personal data or Customer Content, we will notify you without undue delay, and in any event within the period required by applicable law, with what we know and what we are doing.

11. Your rights and choices

Depending on where you live, you may have some or all of the following rights over personal information we hold about you as controller:

• Access. Ask what we hold and receive a copy.
• Correction. Ask us to fix information that is inaccurate.
• Deletion. Ask us to delete your information, subject to what we must keep by law.
• Portability. Receive your information in a portable, machine readable format.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict it.
• Withdraw consent. Where we rely on consent, withdraw it at any time, without affecting processing already carried out.
• Opt out of sale, sharing, and profiling. We do none of these, so there is nothing to opt out of, but the right exists and we honour it.
• Non-discrimination. We will not degrade the Service or charge you differently for exercising a privacy right.

Exercise any of these by writing to support@email.cefense.com. We will respond within five business days, and will complete the request within the period required by applicable law (45 days under California law, extendable once where permitted; one month under the GDPR). We will verify your identity against the account before acting, and we may decline a request we cannot verify.

An authorized agent may submit a request on your behalf with written proof of authorization. Where you are an end user of a customer Organization rather than our direct customer, we will refer your request to that Organization, which is the controller of the content in question.

If you are in the EEA, the UK, or Switzerland, you may lodge a complaint with your local supervisory authority. We would rather you told us first so we can put it right.

You can also disconnect a repository or delete an Organization yourself at any time from the workspace, which is the fastest route to deletion.

12. Cookies

We use cookies and similar local storage sparingly:

• Strictly necessary. Session and authentication cookies set by our authentication provider, and security cookies set by Cloudflare. These cannot be disabled while you are signed in.
• Preference. Local storage holding your theme and workspace layout choices.
• Analytics. Google Analytics cookies, whose names begin with _ga, that measure which pages of our public website are visited and how visitors arrive. Where the law requires consent, they are set only after you accept them, and you can withdraw that choice at any time.

We do not use advertising cookies and we do not permit third-party advertising trackers on the Service. Because we do not track you across sites, we do not respond to browser Do Not Track signals differently. We honour Global Privacy Control signals where applicable law requires it, though we do not sell or share data in the first place.

13. Children

The Service is a business tool and is not directed to children. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, write to support@email.cefense.com and we will delete it.

14. Changes to this Policy

We may update this Policy. When we do, we will change the date at the top of this page. If a change is material, including the addition of a subprocessor that receives Customer Content or a change to how we use your code, we will give at least 30 days' notice by email to the address on your Organization or by a notice in the workspace before it takes effect.

We keep prior versions and will provide one on request.

15. Contact

For any privacy question, a rights request, a concern, or a complaint, write to support@email.cefense.com.

Cefense, Inc.. Contact: support@email.cefense.com.