This Privacy Policy describes how Tomosu AI (“Tomosu,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information in connection with our website, our reliability harness, and any related services (collectively, the “Services”). It applies to website visitors, prospects, customers, customer end users, and anyone who otherwise interacts with us.
If you are a customer’s end user (for example, an engineer at a company that uses Tomosu), the customer’s own privacy policies govern how your data is processed within their environment. Where Tomosu acts as a processor on a customer’s behalf, the customer is the controller; please direct rights requests to them in the first instance.
On this page
- Scope and roles
- Information we collect
- How we use information
- Legal bases for processing
- How we share information
- Sub-processors
- International data transfers
- Data retention
- Information security
- Your privacy rights
- Cookies and tracking
- Children’s privacy
- AI and model training
- Changes to this Policy
- Contact us
1. Scope and roles
This Policy applies to personal information we process in our capacity as a controller, for example, when you visit our website, request a demo, sign up for marketing, or apply for a job. Where we process personal information contained in customer data on behalf of a customer, we act as a processor (or service provider under the CCPA), and our processing is governed by the Data Processing Addendum (“DPA”) executed with the customer.
2. Information we collect
The categories of personal information we collect depend on how you interact with us.
2.1 Information you provide
- Account & identity data: name, business email, business phone, employer, role, password (hashed).
- Sales & marketing data: information you submit on contact forms, newsletter sign-ups, event registrations, or in response to outreach.
- Billing data: invoicing details, tax IDs, billing contact, and the last four digits of payment instruments. Full payment card data is collected and stored by our PCI-DSS-compliant payment processor; Tomosu does not store full card numbers.
- Career applications: resume, work history, references, and right-to-work information you submit through our hiring platform.
- Support communications: messages, attachments, and call recordings (with notice) shared while requesting support.
2.2 Information collected automatically
- Device & log data: IP address, browser type and version, operating system, device identifiers, referring/exit URLs, timestamps, and pages viewed.
- Product telemetry: feature usage, performance, error events, click streams within the Tomosu application, and aggregate session metadata.
- Cookies & similar technologies: see section 11.
2.3 Information from third parties
- Identity providers: if you authenticate via Google, Microsoft, Okta, or another single sign-on provider, we receive the profile fields you authorize.
- Enrichment providers: business contact data sourced from reputable enrichment vendors to support B2B outreach.
- Customer integrations: where you authorize Tomosu to integrate with a source-control, observability, or ticketing system, we receive the metadata required to operate the Services. Specific scopes are documented in the in-product integration flow and the customer DPA.
2.4 Source code and other customer content
Tomosu ingests the contents of the files a scan selects, across the IDE plugin, the PR check and the MCP connector alike; what it excludes is named explicitly below. We retain those file contents, together with what we derive from them, in order to return findings, let you reopen a report, and keep your scores comparable over time.
Specifically, for the files in scope we receive and store:
- Source file contents — the files the scan selects, not your whole repository.
- File and directory paths, and a symbol index of function, class and import names.
- Findings and suggested fixes, which quote the relevant lines of your code.
- Scores and the roll-up reliability index derived from the above.
- Embeddings of the submitted content, used for similarity search.
- Request and response records of the model calls a scan makes, retained for support and investigation.
Where you use the runtime features, we additionally receive the bounded window of application log output that a runner reads, and, if you connect the integration, commit, pull request and issue context, which includes author names.
This content is stored against a per-project key, is not pooled across customers, and is never used to train or fine-tune any model (see section 13). Retention and deletion are described in section 8; you can delete it yourself at any time, as described in section 10. Where self-hosted deployment is in scope of your agreement, this content does not leave your own infrastructure at all.
2.5 Information we do not collect or process
We do not ingest customer secrets, end-user PII captured by your applications, or production database rows. No Tomosu component connects to your production data stores, and we are never given your cloud, observability or database credentials.
On the surfaces where Tomosu selects the files itself, secrets and configuration files — .env, .env.local, .npmrc — along with version-control internals, dependency directories and build output, are excluded by name before any file is opened, so their contents are never read, let alone transmitted. Where you drive the selection yourself — most notably when an AI assistant assembles a request through our MCP server — the files sent are the ones you or your assistant choose, and you should scope those requests accordingly.
3. How we use information
- To provide, operate, secure, and improve the Services, including the Production Reliability Index, the reliability lane, and incident-attribution features.
- To create, administer, and authenticate accounts and to enforce our Terms.
- To process billing, taxes, and collections, and to maintain financial records.
- To respond to inquiries, provide customer support, and send service-related notices (e.g., security advisories, maintenance, policy updates).
- To send marketing communications about products, events, research, and offers, where permitted by law and subject to your opt-out rights.
- To recruit and evaluate candidates for open roles.
- To conduct analytics, product research, A/B experimentation, and quality assurance.
- To detect, prevent, and respond to fraud, abuse, security incidents, and violations of our policies.
- To comply with legal obligations, enforce our agreements, and exercise or defend legal claims.
4. Legal bases for processing (EEA, UK, Switzerland)
Where the GDPR (or its UK or Swiss equivalents) applies, we rely on one or more of the following legal bases:
- Performance of a contract, to provide the Services to a contracting customer and to administer accounts.
- Legitimate interests, to operate, secure, improve, and market our Services, where those interests are not overridden by your fundamental rights and freedoms.
- Consent, for certain marketing activities, optional analytics cookies, and as otherwise required by applicable law. You may withdraw consent at any time without affecting prior lawful processing.
- Legal obligation, to meet tax, accounting, anti-fraud, sanctions, and other legal requirements.
6. Sub-processors
We engage carefully selected vendors to support the Services. Each sub-processor is bound by a written agreement that requires confidentiality, security, and processing limitations consistent with this Policy and the customer DPA.
Current sub-processors:
- Portkey — LLM gateway routing model calls.
- OpenAI, Azure OpenAI, AWS Bedrock — model providers, routed through the gateway above.
- Pinecone, Chroma — vector storage for embeddings and search.
- Neo4j — graph storage for code/ontology relationships.
- Amazon Web Services (AWS) — hosting infrastructure, primary region us-east-1.
This list is kept current as sub-processors change; customers may subscribe to advance notice of changes under the DPA.
7. International data transfers
We may transfer personal information outside your country of residence to jurisdictions where we, our affiliates, or our sub-processors operate. Where required by law, transfers are made under appropriate safeguards, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, the Swiss Federal Data Protection and Information Commissioner’s adequacy frameworks, and additional safeguards as appropriate.
8. Data retention
We retain personal information for as long as needed to fulfill the purposes for which it was collected and to satisfy legal, accounting, or reporting obligations. Typical retention periods are summarized below; customer-controlled data is governed by the customer DPA and configured retention.
| Category | Typical retention |
|---|---|
| Scan content and findings (source file contents, paths, findings, scores) | Life of the project by default, so that trends remain meaningful. Excluded from access immediately on deletion of the project or account, and permanently purged within 30 days; a shorter window can be configured per tenant and recorded in your agreement. |
| Symbol index and embeddings | As above; excluded from all search immediately on deletion and permanently purged within 30 days. |
| Request and response records of model calls | As above; excluded from access immediately on account deletion and permanently purged within 30 days. |
| Runtime incident content (log window, repository context) | Life of the project by default; excluded from access immediately on deletion of the project or account, and permanently purged within 30 days. |
| Content cache | Short-lived; expires automatically. |
| Marketing leads | Up to 24 months from last engagement, unless you opt out earlier. |
| Customer account records | Term of the agreement plus 7 years for tax and audit purposes. |
| Product telemetry | Up to 13 months in identifiable form; aggregated thereafter. |
| Security logs | Up to 12 months, longer if required to investigate an incident. |
| Career applications | Up to 24 months unless you withdraw consent earlier. |
| Support communications | Up to 36 months from case closure. |
9. Information security
We maintain a written information-security program designed in alignment with SOC 2 Type II and ISO/IEC 27001. Controls include, without limitation:
- Encryption of data in transit (TLS 1.2+) and at rest (AES-256 or equivalent).
- Tenant isolation, least-privilege access, and SSO/MFA enforcement on all employee accounts.
- Role-based access control, secrets management, and key rotation.
- Continuous vulnerability scanning, dependency monitoring, and quarterly third-party penetration testing.
- 24x7 monitoring and a documented incident-response plan with notification procedures consistent with applicable law and the customer DPA.
- Background checks and security training for personnel with access to customer data.
10. Your privacy rights
Depending on where you live, you may have the following rights, subject to verification and applicable exceptions:
- Access, request a copy of the personal information we hold about you.
- Correction, ask us to correct inaccurate or incomplete information.
- Deletion, request that we delete personal information. You do not have to wait for us: account holders can delete their own account directly from the Tomosu dashboard, under profile settings. Doing so is irreversible, ends your session immediately, and removes the content described in section 2.4 from the stores that hold it.
- Portability, receive your information in a structured, machine-readable format.
- Restriction or objection, restrict or object to certain processing, including direct marketing.
- Withdraw consent, where processing is based on consent, withdraw it at any time.
- No automated decision-making, we do not make decisions producing legal or similarly significant effects about you using solely automated means in connection with our website. Where used inside the Services, the customer determines whether such processing applies and is the appropriate point of contact.
- Non-discrimination, we will not discriminate against you for exercising any of these rights.
To exercise these rights, email contact@tomosu.ai. We may need to verify your identity before responding. You also have the right to lodge a complaint with your supervisory authority; for EEA residents, that is your local data protection authority, and for UK residents, the Information Commissioner’s Office (ICO).
California residents may designate an authorized agent to make a request on their behalf. Information about Tomosu’s collection, use, and disclosure of personal information in the preceding 12 months is summarized in this Policy.
12. Children’s privacy
The Services are intended for business use and are not directed to children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact contact@tomosu.ai and we will delete it.
13. AI and model training
Tomosu does not train foundation models on customer data. Where we use machine-learning components inside the Services (for example, classifiers used to evaluate AI-generated changes), those components are trained on data we are licensed to use, on data sourced from synthetic or open corpora, or on customer-specific data inside the customer’s tenant where the customer has expressly opted in via the DPA. Customer data is never used to improve the global product without contractual authorization.
14. Changes to this Policy
We may update this Policy from time to time. When we do, we will revise the “Last updated” date at the top, and, for material changes, will notify you via email (where we have one), through the Services, or by posting a prominent notice on our website. Continued use of the Services after the effective date of an updated Policy constitutes acceptance of the updates to the extent permitted by law.
15. Contact us
For privacy questions, requests, or complaints, contact us at contact@tomosu.ai.
