Privacy Policy

1. Information We Collect

We collect the following categories of information when you use Attestry:

Account Information

When you create an account, we collect your name, email address, organization name, and encrypted password. If you subscribe to a paid plan, payment information is processed and stored by Stripe; we do not store credit card numbers on our servers.

AI System Data

When you register AI systems for compliance assessment, we collect the system metadata you provide, including system name, description, model type, intended use, deployment geography, training data source descriptions, and risk classification inputs. We do not collect or store your AI models, training data, or model weights.

Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, assessment activities, API calls, and timestamps. This data is used to improve the Service and ensure security.

Device and Technical Data

We collect your IP address, browser type, operating system, and device identifiers for security, rate limiting, and analytics purposes.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service, including risk classification, compliance assessments, document generation, and attestation certificate issuance
• Authenticate your identity and manage your account and organization
• Process billing transactions and manage subscriptions via Stripe
• Send transactional emails such as assessment completion notifications, attestation certificate issuance, expiration alerts, and regulatory updates
• Monitor and prevent fraud, abuse, and unauthorized access through audit logging and rate limiting
• Comply with legal obligations and respond to lawful requests from authorities

3. Information Sharing

We do not sell, rent, or trade your personal information. We share information only in the following circumstances:

• Service Providers: We use third-party providers to operate the Service, including Vercel (application hosting and infrastructure), Supabase (database hosting and authentication), Stripe (payment processing), Resend (transactional email), Upstash (rate limiting and caching), PostHog (product analytics), Sentry (error and performance monitoring), and Anthropic (AI features — the Reggie assistant, regulatory analysis, and document data extraction). These providers process data on our behalf under contractual data protection obligations. A current list of subprocessors is available on request.
• Public Verification: When you issue an attestation certificate, the certificate hash, system name, risk level, frameworks assessed, and issuance/expiration dates are made publicly accessible through the verification portal. No other data is exposed publicly.
• Legal Requirements: We may disclose information if required by law, regulation, legal process, or governmental request.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction with equivalent privacy protections.

4. Data Retention

While your account is active, you can configure a data-retention period in Settings, from 6 to 84 months (7 years). When you set a period, audit logs, archived evidence, and assessment-linked documents older than that period are removed during regular maintenance. Choose a period that satisfies your longest applicable retention requirement: where a specific regulation requires a longer minimum, set a period at least that long (this setting supports up to 7 years); and where a legal obligation requires you to keep records for longer than the seven-year maximum, do not configure an automatic retention period for them — records in the swept categories are removed at whatever period you set, regardless of any longer obligation. If you do not configure a retention period, these records are retained until you delete your account — they are not removed on any default schedule. Your assessments, attestation records, active evidence, and registry entries are retained for as long as your account is active and are not removed on this schedule.

When you delete your account, we delete your personally identifiable information — together with your assessment, attestation, audit, and other records — immediately from our active systems, with records held by our authentication and payment providers removed promptly afterward. Some limited categories are retained, or expire on their own schedule, rather than deleted immediately:

• (a) Billing and transaction records, which may contain personal data and are retained only as long as required for tax, accounting, and legal obligations.
• (b) Anonymized and aggregated data, which carries no personal identifiers and may be retained for service improvement.
• (c) Residual copies in encrypted backups, which are purged within our backup-rotation window.
• (d) Cached copies, in our content-delivery network, of pages that were already public before deletion (for example a depublished registry listing), which expire automatically within about 8 days.
• (e) Records we are required by law to retain — for example, where a specific regulation mandates a minimum retention period — which, where such an obligation applies, we will keep for the duration of that obligation.
• (f) A public handle — for example a GitHub, npm, or Hugging Face account name — that appears in the name or source link of a publicly-crawled registry listing. When you delete your account we remove the data we can identify as yours; a crawled listing that carries only such a handle may remain, because we cannot reliably confirm that it belongs to your account and we are not obliged to acquire additional information for the sole purpose of making that link. If the listing is yours, tell us — using the takedown link on the listing itself, or at privacy@attestry.ai — and we will remove it.
• (g) A minimal do-not-contact suppression record — your email address, and, when an entire organization account is deleted, the email address of each of its members — which we retain on the basis of our legitimate interest in, and our duty to honor, marketing objections, so that we do not send you marketing or promotional email after your account is deleted. Because this record exists solely to prevent re-contact, it is not removed on any schedule and may be retained indefinitely.
• (h) Limited data held by our sub-processors — listed in Section 3, including our analytics, error-monitoring, transactional-email, AI, hosting, and rate-limiting providers — such as your IP address, a usage identifier, email-delivery logs, and content submitted to our AI features, which is retained on those providers' own schedules rather than deleted by us when you delete your account.

Separately, some personal data relating to you may appear in another organization's records held on our platform — for example, your email address in another organization's tamper-evident audit trail because they invited you or interacted with your account, or your name or contact details in an auditor or registry entry that they maintain. Where we hold such records on that organization's behalf, that organization is the controller and we act as its processor, and it determines the retention and legal basis for those records. You can ask us and we will forward your request to, and assist, that organization, and you may also exercise your data-subject rights directly against it as the controller. Where Attestry is itself the controller of a record — for example a publicly-crawled registry listing — you can exercise your rights against us as described in Section 6.

5. Data Security

We implement industry-standard security measures to protect your data:

• Authentication is managed by Supabase Auth, which uses industry-standard password hashing, OAuth social login, and multi-factor authentication options
• API keys are stored as SHA-256 hashes; raw keys are never stored
• All data is transmitted over HTTPS/TLS and encrypted at rest
• Attestation certificates use SHA-256 hashing for tamper detection
• Rate limiting and audit logging protect against abuse and unauthorized access
• Role-based access control (RBAC) restricts data access within organizations

While we strive to protect your data, no method of electronic transmission or storage is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data, subject to the retention carve-outs described in Section 4. Deleting an account in Settings → Data & Privacy is an organization-administrator action that erases the whole organization; an individual member can ask us to erase their own personal data using the contact details below
• Portability: Request a machine-readable export of your data
• Objection: Object to certain processing of your data
• Restriction: Request restriction of processing in certain circumstances

To exercise any of these rights, contact us at privacy@attestry.ai. We will respond within 30 days.

7. Cookies and Tracking

Attestry uses session cookies managed by our authentication provider (Supabase Auth) to maintain your authenticated session. These cookies are HTTP-only and secure in production. Within the authenticated product, we also use first-party analytics cookies and browser local storage set by PostHog to measure how the product is used (see “Analytics” below). We do not use advertising cookies or cross-site advertising trackers, and we do not share personal data with advertising networks.

Analytics. Within the authenticated dashboard we use PostHog to understand how the product is used — including pages viewed, features used, and interaction events — associated with a first-party analytics identifier stored in your browser. Across the Service we use Sentry to capture application errors and performance data (which may include your IP address, browser, and the page where an error occurred) so we can diagnose and fix problems. We also use Anthropic to power AI features (the Reggie assistant, regulatory analysis, and document data extraction); content you submit to those features is processed by Anthropic to generate responses. We do not use any of this data for advertising, and we do not sell it.

8. International Data Transfers

Your data may be processed and stored in the United States and other countries where our service providers operate. We ensure that any international data transfers comply with applicable data protection laws, including through standard contractual clauses where required.

9. Children's Privacy

Attestry is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Updates to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email at least 14 days before the changes take effect. The "Last updated" date at the top reflects the most recent revision.

11. Contact

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at privacy@attestry.ai.