Privacy Policy
Last updated
This policy explains what ZarbHQ collects when you use Zarb, why, and what we do with it.
What we collect
Account data
Name, email address, organization, role, and authentication credentials. Used to provide access, enforce permissions, and contact you about the Service.
Assessment data
The objectives you write, targets you declare, files you upload, commands generated and executed, output returned, findings recorded, and reports produced. This is your operational content. We process it to run the Service and to support you.
Model interaction logs
Depending on the Service logging configuration, model interaction logs may include prompts, responses, reasoning where a provider exposes it, and token accounting. Prompts include assessment context and may contain material from your environment.
Technical data
IP address, browser and device information, and timestamps of access, retained for security and diagnostics.
Credentials you supply
Where an assessment requires authenticated access, you may supply credentials for the target system. These are stored encrypted at rest and are used only to conduct the assessment you configured.
Be aware: credentials supplied for an assessment may appear in prompts sent to the model providers that power the Service, and therefore in the interaction logs described above. Supply dedicated test credentials with the minimum privilege necessary, and rotate them after an engagement.
Third parties
We share data only with providers necessary to operate the Service: the model providers we run it against, and our hosting and infrastructure providers. We do not sell personal data, and we do not use your assessment content to train models.
Model provider selection
We select model providers on your behalf, and we only operate against providers that contractually commit to zero data retention and to not training on submitted content. Under those terms a provider processes a prompt to return a response and retains nothing afterwards.
This is a selection criterion, not a preference. A provider that cannot offer zero retention and a no-training commitment is not eligible to run assessment traffic, regardless of model quality. Where a provider changes its terms, we move off it.
Retention
Assessment data and interaction logs are retained for the life of your account so that historical assessments remain auditable. You may request deletion of specific assessments or of your account, and we will action it within thirty days except where we are required to retain records by law.
Security
Credentials stored by the Service are encrypted at rest. Access is scoped by organization and enforced at the data layer. API tokens expire and can be revoked. No system is perfectly secure, so we work to a standard we would accept as customers ourselves.
Your rights
Depending on your jurisdiction you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Contact us to exercise any of these.
Contact
Privacy questions: [email protected].
Security issues: [email protected].