Solace Privacy Policy

Last updated: September 14, 2026

This Privacy Policy describes how Cyfrin Inc ("Company", "We", "Us", or "Our") collects, uses, discloses, and protects Personal Data when You access or use Solace (the "Service"). It applies to visitors of the Solace marketing pages and to Account holders.

This Privacy Policy should be read together with the Solace Terms of Service. Capitalized terms not defined here have the meaning given there.

1. Who We Are

The data controller responsible for Personal Data Processed under this Privacy Policy is:

Cyfrin Inc
9066 Cascada Way
Naples, FL 34114
United States
Email: support@cyfrin.io

Solace is sold to individuals. There are no organizations, teams, or seats, and We act as Controller for all Personal Data described here. If You are using the Service on behalf of an employer or client, You remain the Account holder and We look to You as the person We contract with.

2. Scope

This Privacy Policy covers:

• Account registration and authentication data;
• Repository content You bring into Scope for a Scan, and the Findings and Reports produced from it;
• Order, Credit, and billing data;
• Operational, diagnostic, and internal analytics data generated by running Scans;
• Marketing-page visitor data.

3. Personal Data We Collect

3.1 Data You Provide

• Account Data: Solace uses GitHub sign-in only. When You sign in, We receive Your name, email address, avatar URL, and GitHub user ID from GitHub. We do not issue or store passwords, and We do not receive Your GitHub credentials.
• GitHub App installation data: the installation ID, the repositories You grant, and the repository and installation metadata GitHub returns.
• Repository content: the source files and Context Docs at the commit You select, fetched at Scan time under a token scoped to that single repository.
• Communications: messages You send Us through email or support requests.

3.2 Data Generated Through Your Use of the Service

• Measurement data: resolved commit SHAs, eligible file lists, exclusion reasons, nSLOC counts, and deployment-chain inference for repositories You measure — including repositories You measure and never buy a Scan for.
• Findings and Reports: security observations, code excerpts, severity classifications, remediation recommendations, and the rendered Report page and PDF.
• Order and Credit data: Order state, price, Credit grants, pauses, consumption, and revocations. Billing status comes from Our payment processor; We do not receive or store full payment card numbers.
• Usage and operational data: Scan Attempt history, progress events, timestamps, IP addresses, user-agent strings, error and diagnostic logs.
• Failure Evidence: where a Scan Attempt fails, We retain a private, bounded diagnostic bundle — screened report artifacts, parser diagnostics, execution provenance, and a redacted tail of engine output. It excludes full source trees, credentials, and engine checkpoints, and is screened for recognizable secret material before storage. It is never served to You or to anyone outside Our operations boundary.
• Recovery Packages: where a Scan Attempt can be continued rather than restarted, We retain a private, bounded snapshot of engine state, bound to that Scan's inputs, and restore it only into a new isolated Attempt.
• Scan Facts and Repo Fingerprint: see Section 6.

3.3 Data Collected Automatically

• Cookies and similar technologies: session cookies for authentication, and limited first-party analytics. See Section 9.
• Device and connection data: IP address, browser type, operating system, referring URL, pages visited, and approximate location derived from IP.

3.4 Data from Third Parties

• GitHub: profile information returned at sign-in, and repository, installation, and commit metadata returned when You connect and scan a repository.
• Payment processor: billing and settlement status for Your Orders.

3.5 Special Categories

The Service is not intended to Process special categories of Personal Data (GDPR Art. 9) or data relating to criminal convictions (GDPR Art. 10). Please do not submit such data through the Service, including inside a repository You bring into Scope.

4. How We Use Personal Data

We do not use, and We do not permit Our Sub-processors to use, Your repository content, Context Docs, Findings, Reports, prompts, completions, or embeddings to train, fine-tune, or otherwise improve any machine learning or AI model. See Section 5.

5. AI Processing

5.1 How analysis works

A Scan analyzes the files in Scope using large language models. To do that, We transmit the in-scope source files, Context Docs, and intermediate analysis to inference providers, which return the analysis the Report is built from. We do not disclose which models a Scan uses; the configuration is versioned and recorded internally against each Scan so a past Report remains explicable after the configuration changes.

5.2 No training on Your data

All inference is routed through OpenRouter, Inc., which brokers requests to underlying inference providers. We configure that routing with OpenRouter's zero data-collection policy filter, which restricts eligible providers to those that do not use submitted data to train models. Requests are not served by a provider that falls outside that filter.

Providers that serve a request may hold it transiently for the time needed to return a response, and a provider may retain it briefly where its own terms require for abuse monitoring or legal compliance. We do not authorize any other retention or secondary use, and We do not authorize training on Your data by any provider under any circumstances. OpenRouter publishes the data policy of each provider it routes to; the policy in force for a given Scan is available from Us on request.

5.3 Isolation and credential handling

Scans execute in an isolated, network-restricted sandbox with an egress allowlist. Inference credentials are provisioned per Scan with hard spend caps and revoked at the end of the Scan, and are held outside the container that executes Your repository rather than placed inside it.

5.4 Automated decision-making

The Service does not make legal, financial, or employment decisions about individuals, and We do not engage in automated decision-making producing legal or similarly significant effects within the meaning of GDPR Art. 22. Findings are an automated assessment of code, not of a person, and are not a substitute for a professional security audit.

6. Internal Analytics: Scan Facts and Repo Fingerprint

To understand what Scans cost Us and how to price them, We write one immutable internal record per Scan Attempt. Each record carries a Repo Fingerprint — an approximate structural description of the codebase at that commit, such as size and shape distributions, comment density, build framework, test ratio, dependency set, and pragma range — together with what the Attempt cost Us, the engine configuration in force, and the price paid. A Repo Fingerprint is produced whenever a repository is measured, including for repositories that are never scanned or paid for.

This data is pseudonymous, not anonymous. The structural dimensions identify nothing on their own, but the record carries a hashed repository identity that is deliberately joinable back to Your Account and Your repository, because support and debugging require that join. We therefore treat this data as Personal Data under this Policy.

It is never shown to You or to anyone outside Cyfrin, and no individual record is published. We may publish aggregate figures only where the aggregate covers enough repositories that no individual repository or Account is identifiable.

7. How We Share Personal Data

We share Personal Data only as described below. We do not sell Personal Data, and We do not "share" Personal Data for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.

7.1 Sub-processors

We require each Sub-processor to be bound by data protection obligations no less protective than this Privacy Policy. A current list of Sub-processors, including the inference providers eligible under Section 5.2, is available from support@cyfrin.io.

7.2 Legal and Safety Disclosures

We may disclose Personal Data when We reasonably believe disclosure is necessary to:

• Comply with applicable law, legal process, or governmental request;
• Enforce the Terms of Service or investigate potential violations;
• Detect, prevent, or address fraud, security, or technical issues;
• Protect against harm to the rights, property, or safety of the Company, Our users, or the public.

7.3 Business Transfers

If We are involved in a merger, acquisition, financing, or sale of assets, Personal Data may be transferred as part of that transaction. We will notify You and require any successor to honor the commitments in this Privacy Policy.

7.4 With Your Consent or at Your Direction

We share Personal Data with other parties when You direct Us to do so or otherwise consent.

8. International Data Transfers

The Service is operated from data centers in the United States. Account data, Scan data, Reports, logs, and internal analytics are hosted in the United States.

Onward transfers occur to the inference Sub-processors described in Section 5, for the purpose of analyzing the files in Scope. Depending on the provider selected for a given request, an inference provider may be located outside the United States.

Where transfers leave the EEA, UK, or Switzerland to a country not recognized as providing an adequate level of protection (including the United States, except where the recipient is certified under the EU–US Data Privacy Framework), We rely on the European Commission's Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum and Swiss FDPIC amendments) together with supplementary technical and organizational measures.

A copy of the relevant transfer mechanism is available on request from support@cyfrin.io.

9. Cookies and Similar Technologies

We use a small number of first-party cookies to:

• Keep You signed in (session cookies);
• Remember preferences (e.g., theme);
• Measure aggregate usage so We can debug and improve the Service.

We do not use third-party advertising cookies or cross-site tracking. You can control cookies through Your browser settings; disabling session cookies will prevent You from signing in.

10. Data Retention

We may retain Personal Data longer where required by law or to establish, exercise, or defend legal claims.

11. Security

We implement technical and organizational measures designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

• TLS 1.2+ for all external connections;
• Storage-level encryption provided by Our hosting providers, and private, non-public object storage for Report artifacts;
• GitHub OAuth authentication, with no password material held by Us;
• Per-Scan repository tokens scoped to a single repository with read-only contents and metadata access, revoked after use;
• Hardened, network-isolated Scan containers with an egress allowlist, because repository build scripts are executed and a repository is never treated as trusted;
• Per-Scan provisioned inference credentials with hard spend caps, held outside the Scan container and revoked at the end of the Scan;
• No inbound ports on the host that runs Scan containers; the control plane is reached over an authenticated outbound tunnel;
• Least-privilege access to production systems for Cyfrin personnel, with operator actions recorded;
• Screening of diagnostic bundles for recognizable secret material before storage, private filesystem permissions, bounded capacity, and fixed expiry;
• Secrets managed through a password manager and secrets tooling in production, kept out of source control;
• Logging, monitoring, and alerting on defined security signals;
• Confidentiality obligations and security training for personnel.

No system is perfectly secure. Screening cannot establish that arbitrary repository text contains no unknown secret; if a repository You submit contains credentials, rotate them. If You believe Your Account has been compromised, contact Us at security@cyfrin.io.

12. Your Rights

Subject to applicable law, You have the following rights with respect to Personal Data We hold about You:

• Access — obtain a copy of Personal Data We hold about You;
• Rectification — correct inaccurate or incomplete Personal Data;
• Erasure — request deletion of Personal Data, subject to legal retention obligations;
• Restriction — request restriction of Processing in defined circumstances;
• Portability — receive Personal Data You have provided in a structured, commonly used, machine-readable format;
• Objection — object to Processing based on legitimate interests, including direct marketing;
• Withdraw consent — where Processing is based on consent, withdraw consent at any time without affecting the lawfulness of prior Processing;
• Lodge a complaint — with a Supervisory Authority in the EU/EEA, the UK Information Commissioner's Office, the Swiss FDPIC, or another competent authority in Your jurisdiction.

12.1 California Residents (CCPA/CPRA)

If You are a California resident, You also have the right to:

• Know the categories and specific pieces of Personal Information We collect, the sources, the purposes, and the categories of recipients;
• Delete Personal Information, subject to exceptions;
• Correct inaccurate Personal Information;
• Opt out of the "sale" or "sharing" of Personal Information (We do not sell or share Personal Information as those terms are defined under CCPA/CPRA);
• Limit the use of sensitive Personal Information (We do not Process sensitive Personal Information for purposes that trigger this right);
• Non-discrimination for exercising Your rights.

You may designate an authorized agent to make a request on Your behalf, subject to verification.

12.2 How to Exercise Your Rights

You can exercise most rights directly through Service controls — Account settings, Scan and Report deletion, and revoking Our GitHub App's repository access in GitHub. For requests that cannot be completed through the Service, contact Us at support@cyfrin.io. We will respond within the time required by applicable law (generally 30 days under GDPR; 45 days under CCPA/CPRA, extendable as permitted).

13. Children's Privacy

The Service is not directed to individuals under 18 years of age, and We do not knowingly collect Personal Data from anyone under 18. If You believe a child has provided Us with Personal Data, contact support@cyfrin.io and We will take appropriate steps to delete it.

14. Third-Party Sites and Services

The Service may contain links to third-party websites and services. We are not responsible for the privacy practices of those sites and encourage You to review their privacy policies before providing Personal Data to them.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When We make material changes, We will update the "Last updated" date at the top and, where required by law, provide additional notice (e.g., by email or through the Service). Your continued use of the Service after the effective date of an updated Privacy Policy constitutes acceptance of the changes.

16. Contact Us

For questions, concerns, or requests relating to this Privacy Policy or Your Personal Data:

• Email: support@cyfrin.io
• Security: security@cyfrin.io
• Mailing address: Cyfrin Inc, 9066 Cascada Way, Naples, FL 34114, United States

If You are in the EEA, UK, or Switzerland and We do not respond to Your request to Your satisfaction, You may lodge a complaint with Your local Supervisory Authority.

This Privacy Policy is a template intended as a starting point. Before publication, it must be reviewed by qualified legal counsel in each relevant jurisdiction and reconciled with Cyfrin's actual sub-processors, hosting regions, retention schedules, and operational practices.