Legal
Privacy Policy
Production trust surfaces should read like part of the platform: clear ownership, clear contacts, and a calm documentation standard.
Owner
CVERiskPilot LLC
Location
San Antonio, Texas
Last updated
September 14, 2026
Enterprise privacy terms
Enterprise customers may receive a DPA, subprocessor list, and security measures exhibit as part of the contract packet. Those signed terms control where they conflict with this public policy for the covered Services.
1. Scope
This Privacy Policy describes how CVERiskPilot LLC collects, uses, discloses, and protects personal information in connection with our website, hosted application, APIs, documentation, support, sales, and related services.
2. Information We Collect
We may collect account information, contact details, billing and subscription records, authentication metadata, device and usage data, support communications, uploaded files, vulnerability records, compliance evidence, ticket metadata, integration metadata, audit logs, and operational logs. If you use the Claude Code plugin or the MCP server, data leaves your workspace only in response to tool calls authenticated with your organization's API key, and any disposition written back through those tools is recorded in the audit log with that key as the actor.
3. Customer Data
Customer Data is processed to provide the Services on behalf of Customer. Customer is responsible for ensuring it has the rights and notices required to submit Customer Data to the Services. Enterprise data-processing terms may be governed by a signed DPA.
4. How We Use Information
We use information to provide, secure, support, improve, monitor, and operate the Services; process payments; communicate with users; troubleshoot issues; prevent abuse; comply with law; and analyze product usage and reliability.
5. AI Processing
AI-assisted features may send prompts, vulnerability context, case details, and outputs to configured model providers. The providers we use are Corvus, our private model, which runs inside our own Google Cloud project; Google Vertex AI, in the same project; Anthropic; and NVIDIA-hosted models. CVERiskPilot does not use Customer Data to train models. Findings are sent to external providers only for the AI features a customer invokes, and only for the duration of that request.
6. Disclosures
We may disclose information to service providers and subprocessors that support hosting, billing, AI inference, monitoring, analytics, email, security, and support; to Customer administrators; to customer-directed integrations; and when required by law or necessary to protect rights, safety, or security.
7. Subprocessors
We use the following subprocessors to operate the Services: Google Cloud Platform (hosting, storage, and Vertex AI inference; United States); Anthropic PBC (AI inference; United States); NVIDIA (AI inference; United States); Stripe (billing; United States); Resend (transactional email; United States); Sentry (error monitoring; United States); WorkOS (enterprise single sign-on; United States); and Cloudflare (DNS; United States). The current list, with the purpose and location of each, is maintained on our Security and Architecture page, and changes are announced in the changelog.
8. Security
We use administrative, technical, and organizational safeguards designed to protect information, including access controls, tenant scoping, encryption in transit, audit logging, secure credential handling, backup procedures, and vulnerability management practices. No system is perfectly secure.
9. Retention
We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, support security, maintain backups, and keep legitimate business records. Customer Data deletion and return may be governed by a signed agreement.
10. Your Choices
Depending on your relationship with CVERiskPilot and applicable law, you may request access, correction, deletion, export, or restriction of personal information. Some requests must be directed to the Customer organization that controls the relevant account or data. Our public website uses analytics and tag manager cookies to measure traffic and campaign performance; you can block or clear them in your browser settings, and the Services continue to function without them.
11. Restricted Data
Do not submit PHI, PCI cardholder data, classified information, export-controlled technical data, CUI, or other data requiring special contractual handling unless expressly authorized in a signed order form or SOW.
12. International Transfers
CVERiskPilot is based in the United States. If international transfer safeguards are required for an enterprise customer, the parties may address them in a DPA, Standard Contractual Clauses, UK transfer addendum, or another lawful transfer mechanism.
13. Changes
We may update this Privacy Policy from time to time. The updated version will be posted with a revised effective date. Material changes may be communicated through the Services or another reasonable notice method.