1. Scope
This policy covers the website at defensiveai.org and the data clients give us during an engagement. DefensiveAI is the controller of that data.
2. Client source code
Source code and any material you give us for analysis is processed only to perform the engagement you asked for. It is held on infrastructure we control, isolated per client, and access is limited to the analysts assigned to your engagement.
- Retention. Your code and all derived reports are deleted 30 days after delivery. Under a Continuous agreement, they are retained for the life of the agreement and deleted 30 days after it ends. Earlier deletion on written request.
- Training. Your code is never used to train models, ours or anyone else’s. Infrastructure and model providers used to run the analysis are on terms that prohibit training on submitted data.
- Personal data inside a codebase. If code, fixtures, or logs you send contain personal data, we process it only as part of the analysis and delete it on the schedule above. Send redacted or synthetic data where you can.
3. The evaluation form
The form at /start collects your name, work email, company, and optionally a product URL, codebase size, primary stack, and any notes you add. We use it to reply to your request and to run the free evaluation. It is not sold, rented, or shared with anyone outside DefensiveAI, and it is not used for unrelated marketing.
Submissions are kept for 24 months so we have a record of the conversation, then deleted. Ask us at [email protected] and we will delete yours sooner.
4. Email
Mail sent to [email protected] or [email protected] is retained as ordinary business correspondence for as long as the matter is live, and for 24 months after.
5. Website analytics
This site records page views using first-party analytics running on our own infrastructure. There is no third-party analytics service, no advertising network, and no cross-site tracking.
Each page view records the URL, the referring URL, the browser’s user-agent string, screen size, and a country derived from your IP address. A random visitor identifier is stored in your browser’s local storage, and a session identifier in session storage, so repeat visits can be counted without identifying you. Clearing site data removes both. No cookies are set by this site.
We do not attempt to link analytics records to a named person. Server request logs are kept for 30 days for operational and security purposes.
6. Legal bases
Where the GDPR or a similar law applies: we process client code and engagement correspondence to perform a contract; we process form submissions and email on the basis of your request and our legitimate interest in responding to it; we process analytics and server logs on the basis of our legitimate interest in running and defending the site, balanced against the minimal data collected.
7. Your rights
You can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or object to processing. Write to [email protected]. We reply within 30 days. There is no charge.
8. Sharing
We do not sell personal data and we do not share it for advertising. Data is shared only with the infrastructure and email providers needed to run the business, under terms that limit their use of it, and where we are legally compelled — in which case we tell the affected client beforehand unless we are prohibited from doing so.
9. Security of this data
Access is limited to the people who need it, authenticated individually. Client material is isolated per engagement. We publish a disclosure policy so that anyone who finds a weakness in our own properties has a direct way to tell us.
10. Changes
When this policy changes, the date at the top changes with it. Material changes affecting an active engagement are sent to the client’s named contact.
11. Contact
Privacy questions: [email protected]. Vulnerability reports about our own properties: [email protected].
Last updated 14 September 2026. Questions about this document: [email protected]. Related: Terms · Privacy · Disclosure policy.