Privacy Policy

Effective Date: 25 August 2026 | ConformAI Compliance Infrastructure

At ConformAI, we take your data privacy, codebase secrecy, and regional sovereignty with the utmost seriousness. This Privacy Policy outlines how we process and protect your personal information, corporate source codes, policy manuals, and operational metadata in compliance with the EU General Data Protection Regulation (GDPR) and other applicable regional directives.

            GDPR Architecture Highlight: ConformAI operates on a strict zero-retention codebase protocol. Your uploaded files are parsed dynamically in volatile server memory (RAM) and immediately discarded. Source code is never saved to database disks.
        

1. Scope of Data Processing

We process information categorized into the following types:

Account & Organization Data: Registration details including contact names, company email addresses, passwords (securely salted and hashed via PBKDF2-SHA256), corporate tenant mappings, and subscription settings.
Linter Audits Telemetry: Anonymized scan metadata including cumulative scores (AI Act, GDPR, Operations), scanned file counts, detected infractions, and severity tallies. This data is stored to render historical dashboard analytics.
Volatile Code & Policy Payload: Source codes, Terraform configuration files, and policy documents uploaded for scanning. This payload is processed strictly in-memory during active scans and is permanently purged immediately upon endpoint response.

2. Legal Basis for Processing (GDPR Article 6)

We process your data under the following legal frameworks:

Performance of a Contract (Art. 6(1)(b)): To execute compliance checks and deliver remediation blueprints requested by your organization.
Legitimate Interests (Art. 6(1)(f)): To maintain application security, monitor service abuse, prevent malicious file submissions, and improve system performance.
Compliance with Legal Obligations (Art. 6(1)(c)): To cooperate with statutory requirements, such as maintaining tax ledger entries and financial accounting logs.

3. Data Sovereignty & EU Cloud Localization

ConformAI is designed from the ground up to respect strict EU borders:

Infrastructure Isolation: All servers, virtual machines, databases, and AI processing nodes are hosted exclusively within EU cloud zones (Frankfurt, Germany and Madrid, Spain regions).
No US-based Transfers: We do not export codebase payloads or tenant profiles to US-based server locations. All LLM audits are run locally using private hosting weights within our secure VPC.

4. Technical & Organizational Measures (TOMs)

To safeguard your telemetry and registration secrets, we employ standard security measures:

Encryption in Transit & at Rest: All client connections utilize TLS 1.3 protocol. PostgreSQL data directories and backups are encrypted via AES-256 Customer-Managed Keys (CMEK).
Network Isolation: Internal databases and LLM runners are isolated inside private subnets without public internet ingress routes.
Anonymized Code Linting: The scanner only logs the file paths and infraction labels. Snippets containing raw database passwords or API keys are discarded after scanning completes.

5. Your Rights as a Data Subject

Under the GDPR, you have the following enforceable rights:

Right of Access (Article 15): Request a copy of your account profile and historical scan scores.
Right to Rectification (Article 16): Correct outdated registration details or company credentials.
Right to Erasure / "To be Forgotten" (Article 17): Request the permanent deletion of your tenant profile and audit logs.
Right to Portability (Article 20): Export your audit log metrics in structural JSON format.

To exercise any of your statutory rights, please contact our Data Protection Officer at dpo@conformai.tech. We respond to all verified requests within thirty (30) days.

6. Policy Revisions

We may modify this policy periodically to reflect updates in legal frameworks or server architectures. We will notify you of any material changes via your dashboard inbox or registered email.