Legal

Privacy Policy

Draft — pending legal review. This page describes what Aegis actually does with data today, in plain language. It is not yet reviewed by counsel and should not be treated as a final, binding legal document.

What we collect

When you create an Aegis account and organization, we store:

Your name and email address, and a bcrypt hash of your password (never the password itself).
Your organization’s name and the agents, policies, activity events, and audit data you create within it.
Data your own AI agents send to Aegis via the public API and SDK — action names, resources, and any context you choose to include.

We do not collect payment card details ourselves — billing is handled entirely by Paddle, and Aegis never sees or stores your card number.

How we use it

To operate the product: authenticate you, evaluate policy decisions, and show you activity, approvals, security alerts, and cost data.
To maintain an audit trail of actions taken in your organization, for your own accountability and security review.
To communicate with you about your account, such as approval notifications or billing events.

Caller-supplied metadata sent through the public API (event context, evaluation context) is scanned and redacted for anything that looks like a credential (keys, tokens, passwords, secrets) before it is stored — see our Trust & Security page.

Cookies

Aegis sets first-party session cookies only — to keep you signed in and to remember which organization you have active. We do not use third-party advertising or tracking cookies.

Data sharing

We do not sell your data. Data is shared only with the infrastructure providers necessary to run the product (your database host, and Paddle for billing where configured), and never across organizations — every row in Aegis is scoped to the organization that created it.

Data retention and deletion

You can request deletion of your account or organization data by contacting us (see Contact). Configurable retention windows exist in the product for activity data; note that automatic scheduled deletion is not yet implemented — see our documentation for current retention behavior.

Contact

Questions about this policy or a request to access, correct, or delete your data can be sent through our Contact page.