What we collect,
and what we never touch.

What we never do

Stated first, because it matters most and is usually buried:

• We do not train models on your data. Not ours, not a third party's. Captured prompts, replies, documents and screenshots are never used as training or fine-tuning data.
• We do not sell, rent or share your data. Not to advertisers, brokers or partners; not in aggregate; not anonymised.
• We do not analyse your content for our own purposes. No benchmarking, no product analytics derived from what your staff typed, no research corpus.
• We do not read captured content as a matter of routine. In on-premises and bring-your-own-cloud deployments we cannot. In hosted deployments, see access.
• We do not retain your data after the contract ends. Deletion is a contractual obligation with a stated deadline.

Our revenue comes from software licences and support. Nothing about the business depends on your content having a secondary value. That is why these commitments are cheap for us to make, and permanent.

The website

This site sets no cookies, runs no analytics, embeds no third-party scripts and loads no external fonts or trackers. There is no consent banner because there is nothing to consent to.

The one exception is the contact form. What you type into it is sent to our own server and delivered to us by Brevo, our transactional email provider. Your details never reach Brevo unless you submit that form, and nothing about the rest of the site talks to them.

The one preference stored is your light or dark theme choice, kept in your browser's local storage on your own device. It never reaches us.

Our host records standard server logs for security and reliability: IP address, timestamp, requested path, user agent. If you email us or use the contact form, we keep the correspondence to answer you and for our own records. We do not add you to a marketing list, and we do not sell or share it.

The product

When your organization deploys Evidarch, the product records AI interactions by your staff. In that relationship your organization is the data controller and we are a processor. Decisions about what to collect, how long to keep it and who may see it belong to your organization. We act only on its instructions.

What the product records

• Prompts and replies exchanged with AI tools, after on-device redaction has removed detected secrets and personal data.
• Files uploaded to AI tools. Original bytes, a redacted preview, or metadata and a hash only, depending on the policy your organization sets.
• Screenshots of the AI chat window, only if your organization explicitly enables it. This is off by default.
• Identity signals, meaning work email and the identifiers collectors observe, so activity can be attributed to a person.
• Event metadata: time, which AI tool, which collector, which model, and detection findings.

What it never records

• Activity on websites that are not supported AI tools. The browser collector runs only on those sites, and screen capture is refused on any other tab.
• Keystrokes, general browsing history, personal email, or anything typed but never submitted to an AI tool.
• Content on personal devices your organization does not manage.
• Raw secrets and credentials detected by on-device redaction. These are replaced before transmission, and only a hash of the original is kept.

Deployment models

Where captured data lives depends on which pathway your organization chose. We will not blur this:

• On-premises. Everything stays on your infrastructure. No component we operate is in the path. We receive no captured content and could not access it if asked.
• Bring your own cloud. Data lives in your cloud account and region. We hold scoped operational access to run the software; that access is logged and you can revoke it. Captured content is not copied to infrastructure we own.
• SaaS. Captured content is processed and stored on infrastructure we operate, in a single-tenant database in the region you choose, encrypted in transit and at rest. It remains your data throughout.

On-device redaction runs identically in all three, so raw detected secrets never travel regardless of model.

Who can access data

On-premises and bring-your-own-cloud: we have no access to captured content. This is a property of the architecture, not a policy we could quietly change.

SaaS: our staff have no standing access to your captured content. Where diagnosing a genuine incident requires it, access is granted only with your written approval. It is limited to the minimum necessary and to a stated time window, and it is recorded in an audit trail you can see. We will tell you when it happens. You do not have to discover it.

Within your own organization, access is governed by the roles you configure. Bulk export, subject-data packets and erasure are restricted to administrators, and every one of those actions is written to an administrative audit trail naming who performed it.

Retention and deletion

Your organization sets retention. When a period lapses, a sweep removes prompt content and file bytes but keeps the event records and hash chain. Proof that an interaction occurred survives without the content being kept.

A data-subject erasure removes all content and files for one person, and the chain still verifies afterwards. That separation is deliberate. An audit log and a right to erasure are usually in conflict, and this is how we resolve it.

On termination of a SaaS contract we delete your data, backups included, within 30 days, and confirm in writing when it is done. You can export everything before that at any time.

Sub-processors

For the website, one: Brevo delivers the email from our contact form. It receives your name, address and message for that purpose only.

For on-premises deployments there are no sub-processors handling captured content, because none of it reaches us.

For SaaS deployments we use a cloud infrastructure provider for compute and storage, and an authentication provider for sign-in. We maintain a current list, and we will give you advance notice before adding a sub-processor that would handle customer content, so you have time to object.

Optional external anchoring publishes a chain head hash to a destination you nominate. That hash is a fingerprint. It reveals nothing about the events beneath it.

Your rights

Depending on where you are, you may have rights to access, correct, export, restrict or erase personal data held about you, and to object to certain processing.

If you work for an organization using Evidarch, those requests go to your employer, who is the controller. The product is built to let them answer you. A subject packet assembles everything held about one person, and erasure removes it while leaving the audit chain intact. We will help your employer respond, but we cannot act on your data without their instruction.

If you are a customer contact, or you emailed us, write to [email protected] and we will handle it directly.

A note to employees being monitored

If your employer has deployed Evidarch, your interactions with AI tools at work are being recorded. You are entitled to know that. We would rather you read it here than discovered it later.

What is recorded is described above: prompts and replies to AI tools, files you send them, and screenshots of the AI chat window if your employer switched that on. Not your general browsing. Not your keystrokes. Not other applications.

Detected secrets and personal data are stripped on your device before anything is transmitted. You can ask your employer what is held about you and ask for it to be erased, subject to any legal obligation they have to retain records.

Contact

Privacy questions: [email protected]. Security reports: [email protected]. We answer both with a human.

If we change this policy in a way that materially affects how customer data is handled, we will tell affected customers directly. We will not rely on you noticing a new date at the top.