Privacy Policy

1. Introduction and Scope

1.1 Who We Are. Ciphero AI Technologies, Inc. ("Ciphero," "we," "us" or "our"), 99 Wall Street #1148, New York, NY 10005, provides software, a platform and related services that secure and verify AI interactions, and Cassandra, a free extension check (together, the "Services"). Capitalized terms not defined here have the meanings in our Terms of Service.

1.2 What This Policy Covers. This Policy applies to personal information we collect through the Services, our websites, our emails and other interactions with us, including sales, events and support.

1.3 Our Role. For most personal information described here, including account, billing, website, Cassandra and marketing information, Ciphero is the "controller" or "business" that decides how it is used. When a Business Customer uses the Platform to process personal information within its Customer Data, such as prompts, outputs or security logs that relate to its employees or users, Ciphero acts as a "processor" or "service provider" on the Business Customer's behalf under our Data Processing Agreement ("DPA"). In that case, the Business Customer's own privacy notice governs, and individuals should direct requests to that Business Customer. We will assist the Business Customer as the DPA requires.

1.4 Relationship to Our Terms. This Policy is a notice of our practices. It is not a contract and is not part of our Terms of Service. Where our Terms of Service, a DPA or an order form contain commitments about personal information, those documents govern the relationship between Ciphero and the customer who signed or accepted them.

2. Information We Collect

2.1 Information You Provide

• Account and contact information: your name, email address and phone number; for Business Customers, also your organization's name, your job title and department, and your organization's size and industry.
• Billing information: billing name and address, tax identifiers where required, and payment details. Card numbers are collected and stored by our payment processor; we receive only the card type, last four digits and expiration date.
• Customer Data: information you or your users submit to the Platform or that a Ciphero script sends at your direction, which may include event data; AI prompts, inputs and outputs; AI agent settings, skills, tools and metadata; security logs; network traffic metadata; system configurations; and threat intelligence. Customer Data may contain personal information about you or others. Please do not submit sensitive personal information, such as passwords, government identifiers or health information, unless it is necessary for your use of the Services.
• Communications: messages, support requests, feedback, survey responses and communication preferences.
• Sales and event information: details you give us when you request a demo, contact our sales team or register for an event.
• Cassandra and Advisories: a narrower set of information, described in Section 14.

2.2 Information Collected Automatically

• Usage information: features used, actions taken, frequency and duration of use, searches within the Platform, performance metrics and error reports.
• Device and connection information: IP address and approximate location derived from it, browser type and version, operating system, device identifiers, access times, referring URLs and campaign parameters such as UTM tags.
• Cookies and similar technologies: as described in Section 8.

2.3 Information From Other Sources

• Security intelligence sources: public and licensed threat-intelligence feeds and lists of known-malicious software, which may contain identifiers of software publishers.
• Business partners and resellers: contact and order information when you buy through them.
• Fraud-prevention and bot-protection providers: signals that help us verify requests and prevent abuse.
• Public sources: professional information that is publicly available, such as business contact details.
• Your organization: if your employer or organization gives you access to the Services, it may provide your name, email address and role.

3. How We Use Information

We use personal information for the following purposes. Section 11 lists the legal basis for each where the GDPR or UK GDPR applies.

• Providing the Services: creating and managing accounts, running checks and analyses, generating reports and insights, and sending service notifications and alerts.
• Billing and account administration: processing payments, sending renewal reminders and receipts required by our Terms of Service, and handling cancellations and refunds.
• Support and communications: responding to requests and providing customer support.
• Security and abuse prevention: verifying identity, detecting and preventing fraud, spam and abuse, enforcing usage limits and protecting the Services and our users.
• Improving the Services: analyzing usage, fixing errors, developing features and updating our lists of known threats. We do not use Customer Data, Cassandra check data or assistant conversations to train machine-learning models unless you opt in. We may use Usage Data and de-identified or aggregated data, as described in Section 3.1, for this purpose.
• Marketing: sending newsletters and information about our products. We send marketing emails to Consumers only with consent, and to Business Customer contacts as permitted by law. You can opt out at any time.
• Legal and compliance: complying with law, responding to lawful requests, enforcing our Terms of Service, and establishing, exercising or defending legal claims.

3.1 De-identified and Aggregated Data. We may create data that has been de-identified or aggregated so that it cannot reasonably be linked to you or a device. We maintain it in de-identified form, will not attempt to re-identify it except to test our de-identification, and may use and share it for any lawful purpose, including research, threat intelligence and publishing advisories.

4. How We Disclose Information

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We disclose personal information only as follows:

• Service providers: companies that process information on our behalf and under contracts that restrict their use of it, including cloud hosting and infrastructure providers (including those that run automated analysis on our instructions), payment processors, email delivery providers, bot-protection providers, customer relationship management tools, analytics providers, customer support tools, and security and compliance auditors.
• Your organization: if you use the Services through a Business Customer account, that Business Customer can access information about your use, reports and Customer Data you submit under that account.
• At your direction: when you ask us to share information, for example by forwarding a report link or connecting an integration.
• Professional advisers: lawyers, accountants and insurers, under duties of confidentiality.
• Business transfers: a buyer, successor or financing party in connection with a merger, acquisition, financing, sale of assets or bankruptcy, subject to this Policy's protections.
• Legal and safety: where required by law or legal process, to respond to lawful requests from public authorities, or where we believe in good faith that disclosure is needed to protect the rights, property or safety of Ciphero, our users or others, or to investigate fraud or security issues.
• Aggregated data: de-identified or aggregated information as described in Section 3.1.

5. Data Retention

We keep personal information only as long as needed for the purposes in this Policy, then delete or de-identify it. The periods below are our standard practice; we may keep information longer where the law requires it or to resolve a dispute, and only for that purpose.

6. Security

6.1 Safeguards. We maintain administrative, technical and physical safeguards designed to protect personal information, including encryption in transit and at rest, multi-factor authentication for access to production systems, access controls based on job need, regular security assessments and penetration testing, employee training and incident response procedures. We have completed a SOC 2 Type II examination; customers may request the report under a confidentiality agreement. No security measure is perfect, and we cannot guarantee that information will never be accessed without authorization.

6.2 Security Incidents. If we confirm unauthorized access to personal information in our systems, we will notify affected individuals, customers and regulators without undue delay and as required by applicable law and any DPA, and we will take reasonable steps to contain and remediate the incident.

6.3 Your Role. Keep your credentials and any sign-in links we email you confidential. Anyone who has a sign-in link can access what it unlocks until it expires.

7. Your Rights and Choices

7.1 Your Rights. Depending on where you live, you may have the right to: access the personal information we hold about you and receive a copy in a portable format; correct inaccurate information; delete your information; restrict or object to certain processing; opt out of sale, sharing, targeted advertising or profiling (we do not engage in these); and withdraw consent where we rely on it. Sections 10 and 11 describe additional rights under US state and European law. We offer access, correction and deletion to all users regardless of where they live, subject to the exceptions the law allows.

7.2 How to Make a Request. Email contact@ciphero.ai with "Privacy Request" in the subject line, describing what you are asking for. For Cassandra, write from the email address you used and quote the check identifier shown in your report's address bar where relevant.

7.3 Verification. To protect your information, we verify requests by matching information you give us to information we hold, usually by confirming control of the email address associated with your account or check. We may ask for more information for requests involving sensitive data. We will use that information only to verify the request.

7.4 Authorized Agents. Where the law allows, you may use an authorized agent to make a request. We may ask the agent for proof of your signed permission and ask you to verify your identity directly.

7.5 Timing. We respond within the time the law requires, generally within thirty (30) days for requests under European law and forty-five (45) days under US state laws, which may be extended where the law permits. We will tell you if we need an extension and why.

7.6 Appeals. If we decline your request, you may appeal by replying to our decision with "Privacy Appeal" in the subject line. We will respond within the time the law requires. If you are not satisfied, you may contact your state attorney general or your data protection authority.

7.7 Non-Discrimination. We will not deny you Services, charge a different price or provide a different quality of service because you exercised your privacy rights.

7.8 Marketing. You can unsubscribe from marketing emails using the link in any email or by contacting us. We will still send transactional messages about your account, billing and the Services.

7.9 Requests About Customer Data. If your information is in a Business Customer's Customer Data, we process it on that customer's behalf. Please direct your request to that organization; if you contact us, we will forward your request or tell you to contact them.

8. Cookies and Similar Technologies

8.1 Types We Use.

• Essential cookies and local storage: required for sign-in, security, bot protection, load balancing and remembering your consent choice. These do not require consent.
• Analytics cookies: help us understand how our websites and Services are used. Set on our public website only if you opt in.
• Marketing cookies: help us understand campaign performance and manage demo requests. Set only if you opt in.

8.2 Managing Consent. When you first visit our public website, a banner lets you accept or decline analytics and marketing cookies. If you decline, those cookies are not set and the related scripts are not loaded. Your choice is stored in a first-party cookie. You can change it at any time using the "Cookie settings" link in our website footer; if you withdraw consent, we also delete the analytics cookies already set. You can also control cookies through your browser settings, but blocking essential cookies may stop the Services from working.

8.3 Providers. With your consent, we use Google Analytics and PostHog for analytics, and HubSpot, Inc. to understand website usage and manage demo requests. HubSpot may set cookies such as hubspotutk, __hstc, __hssc and __hssrc. These providers process this information on our behalf and under their own privacy policies.

8.4 Global Privacy Control and Do Not Track. We treat a Global Privacy Control signal as a request to opt out of the sale or sharing of personal information and as a decline of analytics and marketing cookies for that browser. Because there is no common standard for Do Not Track signals, we do not respond to them separately.

9. International Data Transfers

Ciphero is based in the United States, and we and our service providers process information in the United States and other countries whose data protection laws may differ from yours. When we transfer personal information from the European Economic Area, the United Kingdom or Switzerland to a country that has not been found to provide adequate protection, we use appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and their Swiss equivalents. You may request a copy of the safeguards we use by contacting us.

10. US State Privacy Rights

10.1 California. If you are a California resident, the California Consumer Privacy Act, as amended ("CCPA"), gives you the right to know what personal information we collect, use and disclose; to access, correct and delete it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. These rights apply to Consumers and to individuals who interact with us for a Business Customer. Make requests as described in Section 7.

In the past twelve (12) months, we have collected the categories of personal information below, from the sources in Section 2, for the purposes in Section 3. We retain each category as described in Section 5.

We do not sell or share personal information and have not done so in the past twelve (12) months. We have no actual knowledge of selling or sharing personal information of anyone under sixteen (16). We use sensitive personal information only for purposes the CCPA permits, such as providing the Services and keeping them secure, so the right to limit does not apply.

10.2 California "Shine the Light." We do not disclose personal information to third parties for their own direct marketing purposes.

10.3 Other States. Residents of Colorado, Connecticut, Virginia, Texas, Oregon and other states with comprehensive privacy laws may have rights to confirm whether we process their personal data, and to access, correct, delete and obtain a copy of it, to opt out of targeted advertising, sale and certain profiling, and to appeal our decision on a request. We honor these rights as described in Section 7, including the appeal process in Section 7.6.

11. European Economic Area, UK and Swiss Rights

11.1 Controller. Ciphero AI Technologies, Inc. is the controller of the personal information described in this Policy, except where Section 1.3 says we act as a processor.

11.2 Legal Bases. We rely on the following legal bases:

Where we rely on legitimate interests, we have balanced them against your rights. You may ask us for details of that assessment.

11.3 Your Rights. You have the right to access, correct, delete, restrict and port your personal data; to object to processing based on legitimate interests, and to object at any time to direct marketing; and to withdraw consent at any time without affecting earlier processing. You may also lodge a complaint with the supervisory authority where you live or work, or with the UK Information Commissioner's Office or the Swiss Federal Data Protection and Information Commissioner, as applicable.

11.4 Required Information. Some personal information is needed to provide the Services, such as an email address to deliver a report. If you do not provide it, we may be unable to provide the Service you requested.

12. Automated Processing and AI

Some Services use automated systems, including machine-learning models operated by us or by infrastructure providers acting on our instructions, to analyze data, write report analysis and answer questions. Cassandra's verdicts are produced by fixed rules that compare reported facts against lists of known threats.

These systems produce security information about software and devices. We do not use them to make decisions about individuals that produce legal or similarly significant effects, such as decisions about credit, employment or access to essential services. We do not use Customer Data, Cassandra check data or assistant conversations to train machine-learning models unless you opt in, and our infrastructure providers may not use them to train their models.

13. Children, Third-Party Sites and Changes

13.1 Children. The Services are not intended for anyone under eighteen (18), consistent with our Terms of Service. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it promptly. If you believe a minor has given us information, contact us at contact@ciphero.ai.

13.2 Third-Party Sites and Services. The Services may link to third-party websites, marketplaces and integrations. Their privacy practices are governed by their own policies, and we are not responsible for them.

13.3 Changes to This Policy. We may update this Policy from time to time and will post the updated version with a new "Last updated" date. For material changes, we will give at least thirty (30) days' notice by email or in the Services before they take effect. We will not apply a material change that reduces your privacy protections to personal information we collected before the change without your consent where the law requires it.

14. Supplemental Notice: Cassandra and Advisories

This Section describes the information we handle when you use Cassandra, our free extension check at ciphero.ai/cassandra, and when you subscribe to the AI supply-chain advisories at ciphero.ai/advisories. It supplements the rest of this Policy, which continues to apply. Cassandra is used without an account, so most of what we hold comes from the three places below.

14.1 What We Collect

From you, on our pages. The email address you enter to start a check, receive a sign-in link or subscribe to advisories; when you start a check, a record that you accepted our Terms of Service, when, and which version was in effect; the messages you type to the assistant on a report; and, if you ask us to contact you about a Ciphero product, your name, company and, optionally, your role, team size and a note.

From your browser. A one-way keyed hash of your IP address (we do not store the address itself with a check or subscription), your browser's user-agent string, the referring page and any campaign parameters in the link you followed. An essential session cookie remembers which checks this browser started and, once you open the emailed link, the email address it verified. Our bot protection uses a hidden form field, form timing and, where enabled, Cloudflare Turnstile, which processes your IP address and browser signals under Cloudflare's privacy policy. We look up the mail servers for your email domain through DNS to confirm it can receive email. Cassandra's pages load fonts from Google Fonts, which receives your IP address when they are fetched. Your light or dark theme choice stays in your browser's local storage and is not sent to us. Cassandra's pages set no analytics or marketing cookies.

From the collector script, only after you confirm in your terminal. The script shows you every fact it has gathered and sends nothing until you say yes. If you do, we receive:

• your operating system, processor architecture, the device's short host name and the script's version;
• for each supported editor, the folder names of installed extensions (publisher, name and version) and, where present, the names of extension records marked obsolete, the file names and SHA-256 hashes of cached extension packages whose names match a known-malicious extension, and whether the editor's own install log mentions a known-malicious version;
• where a version named in a published incident is installed, the SHA-256 hash of that extension's main code file and a yes or no for whether it contains the attacker strings the incident published, never the file itself;
• for each supported browser, the identifiers and versions of installed extensions;
• a yes, no or "could not check" answer for each item on a fixed list of indicators of specific published incidents, such as whether a particular file or folder exists, a particular file contains a particular string, an SSH key has a particular fingerprint, a particular launch agent, scheduled task or startup entry is registered, or there is an open connection to a particular address. To answer, the script reads a fixed list of places: named files and folders, your shell start-up files, your own crontab, your user launch agents, systemd units, autostart entries, Run keys and scheduled tasks, the running process list, and the code files of your installed editor extensions;
• for each "yes", the name of what matched and nothing more: a file name (for example a key file in your .ssh folder or a launch agent), a Run key value name, a scheduled task name, or the folder name of the extension concerned, never its path or contents;
• the names of AI tools found on your system path or in your Applications folder; and
• the names, never the values, of environment variables whose names match common API-key patterns.

The script is designed not to read or send file contents, secret values, browsing history, documents or anything outside these lists. A host name can include your name, file names in your home folder can reveal the services you use, and extension lists can reveal your employer, projects or interests.

14.2 How We Use It

• To run your check: we compare what the script reported against known-malicious lists and published incident indicators to produce your report's verdict, risk level and findings.
• To look up your extensions: we send the identifiers and versions of the editor extensions found to the public registries those editors install from, operated by Microsoft (Visual Studio Marketplace) and the Eclipse Foundation (Open VSX), to learn whether each is still listed, whether its installed version is still served, and who publishes it. We also send the identifiers of the browser extensions found to the public stores those browsers install from, operated by Google (Chrome Web Store), Microsoft (Edge Add-ons) and Mozilla (Firefox Add-ons), to learn each extension's listed name so that your report can name it rather than quote an identifier. These requests come from our servers and contain extension identifiers only, never your email address, host name or IP address.
• To write the analysis and answer your questions: automated systems, including machine-learning models operated by us or by infrastructure providers on our instructions, generate the written analysis and the assistant's replies from your check, your messages and public information about the relevant extensions and incidents. We do not use your check data or conversations to train machine-learning models. Messages are screened automatically for attempts to manipulate the assistant, and we may review conversations to prevent abuse, keep the assistant safe and improve Cassandra.
• To deliver your report and keep you signed in: we email the report and its sign-in link to the address you gave and use the session cookie so you can follow your check.
• To protect the service: we use the hashed IP address, form signals, Turnstile results, DNS checks, single-use tokens and per-address limits to prevent spam, abuse and fabricated data, and to enforce our Terms of Service.
• To follow up when you ask: if you request information about a Ciphero product, we create a sales lead containing your name, company, role, team size, note, email address and a short summary of your check (risk level, device label, number of extensions found and names of AI tools seen). We email it to our team and store it in HubSpot, our CRM provider. We do not add you to a marketing list without your consent.
• To send advisories, if you subscribe: sign-up is a double opt-in, and nothing is sent until you confirm from the email we send. Choosing "Notify me" on a report you opened from its emailed link counts as confirmation. Each advisory email has an unsubscribe link.
• To improve detection: we use identifiers of extensions Cassandra flagged, and aggregate statistics that cannot identify you, to maintain our lists, publish advisories and improve Cassandra.

14.3 Legal Bases

Where the GDPR or UK GDPR applies, we process this information to take the steps you asked for (running your check, delivering your report, answering your questions and contacting you when you ask); for our legitimate interests in securing Cassandra and its users, preventing abuse, improving the service and protecting the developer ecosystem from malicious extensions; and, for advisory emails and any marketing, on the basis of your consent, which you can withdraw at any time.

14.4 Who We Share It With

In addition to the recipients in Section 4: Cloudflare, Inc., for bot protection; Google, when Cassandra's pages load fonts; the marketplace and store operators named above, which receive extension identifiers only; the infrastructure providers that host our systems and run automated analysis on our instructions; our email delivery provider; and HubSpot, Inc., when you ask us to contact you. We do not sell this information or share your email address, host name or extension lists with advertisers or data brokers.

14.5 How Long We Keep It

14.6 Your Choices

You can read the script before you run it and decline to send anything when it asks. You can choose not to use the assistant; if you use it, do not enter passwords, keys, secrets, confidential information or personal data about other people. You can ask us to delete a check, conversation, lead or subscription at any time as described in Section 7.2. You can unsubscribe from advisories using the link in any advisory email. Your rights under Sections 7, 10 and 11 apply to all of this information.

15. Contact and Complaints

15.1 Contact Us. For questions about this Policy or to exercise your rights, contact our privacy team:

Ciphero AI Technologies, Inc.
Attn: Privacy
99 Wall Street #1148
New York, NY 10005
Email: contact@ciphero.ai

15.2 Complaints. If you have a concern about our privacy practices, please contact us first so we can try to resolve it. You may also contact your data protection authority or, in the United States, your state attorney general, and you may seek other remedies available under applicable law.