Back to Home
SigmaSecDATA PRIVACY
Trust & Transparency

Privacy Policy & Data Handling

Effective Date: September 2026 · Version 1.2

Self-Host Option

Self-host SigmaSec and your code never leaves your infrastructure. On the hosted service, repositories are cloned only for the duration of a scan.

No AI Training

SigmaSec doesn't train or fine-tune models on customer data. AI can run fully local (Ollama) or on Claude via Anthropic's API.

Data Residency

Self-hosted deployments keep data wherever you run them, including Indian cloud regions. For the hosted service, ask us for the current region.

01 Information We Collect

SigmaSec collects only what it needs to scan, prioritise and help remediate vulnerabilities:

  • Account information (name, work email address, organization identity, authentication credentials).
  • Vulnerability finding metadata (CVE IDs, EPSS scores, CVSS vectors, file paths and tool execution logs).
  • Short code snippets around a vulnerable dependency's call sites, used for the dependency usage check.
  • For committed secrets, a masked value and a hash only; raw secret values are never stored.
  • Audit records of actions such as scans started, settings changed and fix pull requests opened.
  • On the hosted service, repository contents are cloned temporarily during a scan and deleted afterwards.

02AI Inference & Model Data Usage

SigmaSec uses an AI model to explain findings in plain English and suggest remediation. You choose the model: a local Ollama model, or Anthropic's Claude API.

  • Local option: with Ollama, prompts never leave your deployment.
  • Claude option: prompts are sent to Anthropic's API and handled under Anthropic's commercial terms.
  • Before any prompt is sent, recognisable secrets (API keys, tokens, private keys, JWTs) are redacted.
  • SigmaSec does not use customer code, findings or prompts to train or fine-tune models.

03Data Storage & Security Controls

Current controls (self-hosted deployments inherit the controls of the infrastructure you run them on):

  • Encryption in transit: traffic to the SigmaSec web app and API is served over HTTPS.
  • Integration credentials: GitHub, Jira and Slack tokens are encrypted at the application layer before storage.
  • Tenant isolation: every query is scoped to your organisation in the application layer.
  • Audit logging: scans, settings changes and integration actions are recorded in an audit log.

04 Contact Information

For questions regarding this policy or data protection inquiries, contact our data protection team directly at privacy@sigmasec.ai.