Privacy and Data

Privacy and Data

This page is a short summary. The full, binding version is our Privacy Policy, and our Terms of Service apply to your use of XHack. If anything here differs from the Privacy Policy, the Privacy Policy applies.

The XHack AI Agent

• We do not store the chats of your agent sessions. The agent runs on your machine and keeps its prompts, responses, tool output and files there.
• Hosted model. If you use the XHack hosted model, your prompts and its responses pass through our systems so a response can be generated. We do not store them.
• Local models. With a local model, nothing leaves your machine.
• Your own key. With Bring Your Own Key, data goes between your machine and the provider you chose. That provider's terms apply.
• Audit logs. We keep audit logs of account and security events, such as sign-ins, plan changes and usage. They do not contain your chats, prompts or responses.

The platform

When you use the organization platform, we process the data you add or connect so the features work, including SOC events, scan results and findings, and AI Probe targets and transcripts.

• Web chat conversations are saved so you can return to them, until you delete them.
• Cloud Investigation logs you upload are deleted right after the investigation completes. The report is kept until you delete it.
• GitGuard analyses pull request code when a scan runs and does not store it.
• Keys and credentials are encrypted at rest.

Verification

Access to XHack is verified. Identity documents are encrypted and are deleted 30 days after you delete your account.

Your rights and questions

You can ask to access, correct or delete your data, or raise a concern, by emailing support@xhack.io. See the Privacy Policy for the details.