Trust & Security

How we handle your data

This page is the contract. Three privacy modes, a data-flow diagram, the exact subprocessor list, and the security controls behind them. If anything here changes, the changelog shows it.

Live Trust page on dashboard security@talosfoundrix.com

Data flow

Your laptop → the agent (redacts per privacy mode) → Cloudflare edge (API, D1, R2) → your dashboard. Nothing skips a hop.

1. Your laptop

The agent watches Claude Code + Cursor log files. It redacts per the team's privacy mode before anything is sent.

2. Cloudflare edge

Workers API (Hono) validates, de-duplicates, and pushes events into D1 and R2. Sonnet 4.7 runs on aggregates only (never raw).

3. Your dashboard

Team KPIs, per-dev drilldown, Slack alerts, AI insights. Prompts are visible only if the team chose the Full mode.

Privacy modes — what leaves your machine

The default is Off — no prompt content ever touches our servers. Admins pick the team-wide mode; developers can always fall back to a stricter mode unilaterally (we log it, but can't stop it).

Off

Default

Leaves your machine

→Token counts (input + output)
→Model name
→Timestamp
→Git branch name (hashed)

Stays on your machine

×Prompt text
×Completion text
×Any file content

Teams that want the numbers but not the content.

Categorize (cloud)

Opt-in

Leaves your machine

→Prompt text sent to Cloudflare edge
→Haiku classifies: category, task hint, project hint, confidence
→Raw text discarded after categorization (~2s)

Stays on your machine

×The original prompt is NOT stored — only the structured output
×Completion text (not sent)

Teams that want per-project breakdown but don't want prompts archived.

Categorize (local)

Zero-egress

Leaves your machine

→Only structured category + hints (no raw text)
→Ollama (llama3.1:8b) runs on your own machine

Stays on your machine

×Prompt text — never leaves the machine
×Completion text — never leaves the machine
×Any file content

Privacy-first teams. Requires Ollama installed locally.

Full

Team-approved

Leaves your machine

→Full prompt text
→Full completion text

Stays on your machine

×Source code (never read)
×Anything outside log files

Teams debugging high-cost sessions, with all members consenting.

Subprocessors

These are every third party that touches your data. If we add one, the live Trust page publishes a diff before it takes effect.

Vendor	Role	Region
Cloudflare	Workers, D1, R2, Queues, Workflows (API + data)	Global edge, EU-routed by default
Clerk	Authentication & user management	US (Clerk infra)
Stripe	Payment processing	US/EU
Anthropic	Haiku (cloud categorize) + Sonnet 4.7 (insights, aggregates only)	US
Resend	Transactional email (invites, trial reminders)	EU/US
Slack	Optional alerts integration (admin-installed)	US

Infrastructure

Talos Auditor runs on Cloudflare's edge — regional latency for every seat, high durability, no single-region single point of failure. The stack is boring on purpose.

Workers

Hono-based API, stateless, multi-region

SQLite — team, usage, and billing data

Raw event archive (purged per retention)

Queues

Ingest + alert delivery + DLQ

Workflows

Daily, weekly, hourly cron jobs

Durable Objects

Per-team rate limiting

Security controls

The boring but load-bearing stuff.

AES-256-GCM outbox encryption

Agent outbox is encrypted with a key held in the OS keychain (macOS Keychain, Linux libsecret, fallback to 0600 file).

TLS 1.2+ everywhere

All traffic to API is HTTPS. Agent uses certificate-pinned TLS.

Retention enforcement

Nightly cron at 03:30 UTC prunes raw data per team retention setting. Mode downgrade triggers 7-day grace + R2 purge.

Audit logging

Every team-affecting mutation (invite, role change, privacy mode change) logged with 730-day retention.

Token hashing

Agent tokens stored as SHA-256 hashes; plaintext never stored at rest.

Least-privilege scopes

Agent reads log files only. No source code access. The extension only calls /v1/agent/status.

Compliance

→SOC 2 Type I readiness in progress. Full Type II audit planned post-launch (6-month observation window).
→KVKK + GDPR aware. KVKK text and GDPR DPA template drafted; final copies ship with Estonian OÜ incorporation.
→Apache-2.0 open-source agent — audit every line of what we ship to your machine.
→Estonian OÜ jurisdiction (incorporation pending). Data residency defaults to Cloudflare EU routing; custom regions on Enterprise.

Get in touch

Responsible disclosure

security@talosfoundrix.com

2-business-day acknowledgement. 7-day fix SLA for critical severity.

DPA / custom terms

info@talosfoundrix.com

Back to product