What we collect when you sign up, run a workflow, send a payment through Stripe, or open a ticket. Written in plain terms so you can hand it to your DPO without a translation layer.
CipherRun is the data controller for personal information submitted through the
customer dashboard at /app, the public-facing API at /api/v1,
the waitlist and early-access forms on the marketing site, and the Stripe checkout
hosted at /pricing. It covers data we collect, why we collect it,
who we share it with, how long we keep it, and the rights you have over it.
We collect six explicit categories of data:
| Category | What | Where it lives |
|---|---|---|
| Account | Email, Stripe customer ID, API key prefix (cr_ws_…), workspace name, role (admin/editor/viewer), tier assignment |
customers, workspaces, workspace_users |
| Billing | Card last-4 + brand only (Stripe holds the PAN; CipherRun never sees it), subscription status, current period end, invoice history | subscriptions + Stripe dashboard mirror |
| Workflow runs | YAML inputs submitted, step outputs captured during execution (verdict, score, extracted IOCs). Raw credentials stored in integrations.config are encrypted — never written to run logs. |
workflow_runs, execution_logs |
| Operational events | IP address, user-agent, and referrer of inbound requests; kept for security log retention only, deleted by §5. | analytics_events + inferred from outreach_messages / outreach_replies |
Outbound transactional email (magic-link tokens, early-access nurture, weekly practitioner digest). Inbound replies captured by the Postmark webhook to routes/postmark-webhooks.js are stored in outreach_replies. |
Postmark (US datacenter) + practitioner_leads, digest_log, outreach_messages, outreach_replies |
|
| Support tickets | Anything you send to legal@, security@, support@, or privacy@. Includes the message content, metadata (sender, timestamp), and any files you attach. |
Encrypted archive, 2-year retention (see §5) |
workflows/FIELD-CONTRACT.md.services/email-* includes an unsubscribe link in the footer (the practitioner digest footer bakes a 32-byte hex unsubscribe_token from practitioner_leads, and the nurture sequence at routes/practitioners.js stops sending once flipped).The following vendors process data on CipherRun's behalf. This is the GDPR sub-processor disclosure required by Art. 28, plus the card-network disclosure required for PCI DSS Level 1 merchants using Stripe.
| Vendor | Purpose | Region | Compliance |
|---|---|---|---|
| Stripe Payments Europe Ltd. | Card processing, invoice generation, webhook delivery | US / EU | PCI DSS Level 1; DPA on file |
| Postmark (ActiveCampaign LLC) | Transactional email (magic links, nurture, digest) | US | DPA executed |
| Render Inc. | Application hosting | US | DPA executed |
| Neon (Databricks Inc.) | PostgreSQL hosting | US | DPA executed |
| Cloudflare R2 | File / object storage (used by workflow attachment steps via the Polsia platform proxy) | Global edge | DPA executed |
We notify subscribers on the email list in §3 at least 30 days before adding a new sub-processor. The list above is the canonical version.
Concrete numbers — the schedule governs both production and any backups held longer by the platform.
| Data class | Window | After expiry |
|---|---|---|
| Account + billing (customers, subscriptions) | Life of account + 7 years | Hard deleted; tax-record copy retained for IRS / HMRC audit |
| Workflow run logs (workflow_runs, execution_logs) | 90 days hot, then aggregate-only counters | Per-step verdicts and step outputs deleted; counters (run count, score distribution) kept |
| Auth tokens (auth_tokens) | 15-minute TTL; consumed on verify | Never persisted after consumption — burned at first use |
| Magic-link tokens | Single use; expired after 15 minutes | Burned and deleted |
| Workspace invite tokens (workspace_invites) | 7-day TTL | Hard deleted; pending roles rolled back |
| Analytics events (analytics_events) | 12 months; then aggregated | Raw event payloads deleted; rollup tables kept |
| Security disclosure inbox | 2 years | Hard deleted unless part of an active case (then retained to case close) |
Under the GDPR (and mirrored rights under the UK GDPR, CCPA, and similar regimes) you have the right to:
/app or by emailing us.Email privacy@cipherrun.io (or legal@cipherrun.io as fallback). We respond within 30 days, or 60 days for complex requests where Art. 12(3) GDPR allows the extension. Where we cannot fulfill a request, we explain the legal basis.
CipherRun uses only localStorage on the customer surface — the cr_onboarding
onboarding-checklist state, the cr_theme light/dark mode toggle, and the
30-day JWT session cookie used by middleware/require-auth.js. The Meta Pixel
(ID 1735807277592543) runs on marketing surfaces (landing.ejs,
pricing.ejs, the waitlist modal at views/partials/waitlist-modal.ejs)
and does not load on /app, /login, /admin/*, or any
API endpoint. We do not run any third-party retargeting pixels on authenticated product
surfaces.
CipherRun Inc. is headquartered in the United States. For data subjects in the European Economic Area, the United Kingdom, or Switzerland, transfers to the US rely on Standard Contractual Clauses (SCCs) executed with Stripe and Postmark, and on adequacy decisions where available. The current set of executed SCCs is available on request from privacy@cipherrun.io.
Encryption in transit is enforced end-to-end (TLS 1.2+). Credentials stored in
integrations.config (your Jira and ServiceNow tokens) are encrypted at rest.
Access control is gated by the admin/editor/viewer RBAC chain in
middleware/require-workspace.js. CipherRun is actively working toward a SOC 2
Type II audit; our responsible-disclosure policy at /security is
the same commitment we make to auditors. Security disclosures go to
security@cipherrun.io per that page; nothing in this privacy policy replaces
the disclosure scope and safe-harbor at /security.
CipherRun is a business service. It is not intended for children under 16, and we do not knowingly collect personal data from anyone under 16. If we become aware that we have, we will delete the record and notify the guardian that submitted it.
Material changes get the same notice regime as Terms §11 — at least 14 days of email notice plus a Postmark blast, with an updated effective date at the top of this page. Non-material changes are posted silently.
Our Data Protection Officer is reachable at privacy@cipherrun.io. Postal correspondence: CipherRun Inc., [registered address — will be filled before the SOC 2 Type II audit cycle closes]. You also have the right to lodge a complaint with your local data-protection supervisory authority; nothing in this section limits that right.
Post-termination data handling is governed by the retention windows in §5; account closure itself is described in /legal/terms §7.