1. Introduction
This Privacy Policy explains how Vouch Security Inc. ("Vouch," "we," "us," or "our") collects, uses, discloses, and protects information in connection with the Vouch platform, including vouch.security, console.vouch.security, our active production deployment at https://vouch-eta-one.vercel.app/, our APIs, GitHub App integration, CLI utilities, and related services (collectively, the "Service").
This Privacy Policy forms an integral part of our Terms of Service. By creating an account, connecting a repository, or using the Service, you acknowledge and agree to the data practices described herein.
2. Information We Collect
2.1 Account and Identity Information
When you register for an account or authenticate into Vouch, we collect your full name and professional email address. If you authenticate via third-party identity providers (GitHub OAuth), we receive your provider username, verified email, avatar URL, and account identifier. Passwords are salted and cryptographically hashed; plaintext passwords are never stored.
2.2 Repository & Source Code Content
When you authorize a Git repository for automated security auditing or vulnerability scanning, we process the source code and directory hierarchy needed to build an abstract syntax tree (AST) and execute taint analysis. Dependency manifests (package.json, requirements.txt, go.mod) are inspected for known CVEs and malicious packages.
We do NOT use your proprietary source code, repository metadata, or synthesized patches to train public foundational AI models.
2.3 Third-Party Authorization & Token Storage
When connecting your GitHub account or GitHub App, we receive scoped OAuth access tokens (repository read access, pull request review access, and webhook events). Tokens are stored in encrypted, HttpOnly, Secure cookies or AES-256 encrypted database records.
2.4 Telemetry & Operational Logs
We automatically log IP addresses, HTTP request methods, response status codes, endpoint latencies, and user-agent strings for DDoS mitigation, rate limiting, and brute-force defense. In production environments, operational telemetry and application health metrics are processed via our dedicated PostgreSQL cluster and PostHog, Inc. with automatic 30-day retention pruning.
2.5 Billing & Payments
Subscription billing, enterprise seats, and audit credits are processed through our PCI-DSS Level 1 compliant payment processor (Stripe, Inc.). Vouch does not store raw credit card numbers.
3. How We Use Your Information
We process personal and technical data for the following legitimate business purposes:
- Executing autonomous multi-agent AST security audits and generating validated PoC exploit commands;
- Enforcing workspace role-based access control (RBAC) and multi-tenant security domain isolation;
- Generating HMAC-SHA256 digitally signed security certification badges and audit manifests;
- Correlating Common Vulnerabilities and Exposures (CVEs) with codebase dependencies;
- Protecting against unauthorized scanning, brute-force login attempts, and platform abuse.
4. Sub-Processors & Data Sharing
We share data with trusted sub-processors strictly as required to provide the Service, governed by Data Processing Agreements (DPAs):
| Sub-Processor | Category | Purpose | Region |
|---|---|---|---|
| PostgreSQL Serverless Cluster | Serverless PostgreSQL DB | Primary relational storage, connection pooling, and live telemetry cluster | AWS us-east-2 |
| PostHog, Inc. | Analytics & Telemetry | Production telemetry, error monitoring, and user interaction diagnostics | US Cloud |
| GitHub Inc. (Microsoft Corporation) | Developer Platform | OAuth auth, repo code tree ingestion, webhooks, and PR bot review comments | US / Global |
| Resend, Inc. | Transactional Email | Security notifications, password resets, and service request intake dispatch | US East |
| Vercel Inc. | Edge Infrastructure | Application hosting, CDN, edge routing, and serverless compute | Global Edge |
| Stripe Inc. | Payment Processing | Invoicing, subscriptions, and billing (PCI-DSS Level 1) | US / Global |
| TiDB Cloud (PingCAP) | Vector Database | Semantic retrieval & AST embedding indexes | AWS eu-central-1 |
| PostgreSQL Relational DB | Primary Database | User accounts, audit reports, threat rules | AWS eu-central-1 |
We do not sell, rent, or trade your personal information or proprietary code to any third party.
5. Data Retention & Deletion
Raw IP logs are retained for 30 days and then pruned. Audit findings remain stored for the lifetime of your active workspace to maintain compliance history. You can request permanent account and workspace deletion at any time in Settings (/settings) or by contacting legal@vouch.security, which immediately purges all database records.
6. Global Privacy Rights (GDPR & CCPA)
You have the right to access, rectify, port, or erase your personal data under the European Union General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA). To submit a verified request, contact legal@vouch.security. We respond within thirty (30) calendar days.