Privacy Policy

Belfry Labs operates the Belfry Atlas product at app.belfrylabs.ai and the marketing site at belfrylabs.ai (together, the "Service"). This policy explains what information we collect, how we use it, and the choices you have.

Questions: use the contact form, email privacy@belfrylabs.ai, or security reports to security@belfrylabs.ai.

We collect the minimum needed to run the Service:

• Account data — email, name if you provide it, authentication identifiers from Google, GitHub, or your company SSO, and organization name.
• Workspace data — tenant settings, project metadata, plan and complimentary-scan usage, GitHub App installation id and account login.
• Scan and review artifacts — findings, severity, file paths, and reports produced when you run scans or a Security & Architecture Review. We do not use this content to train foundation models.
• Operational logs — request metadata, timestamps, and error records needed to operate, secure, and debug the Service.
• Contact messages — email and message if you write to us.

We use this information to authenticate you, isolate data by tenant, run scans and reviews you request, count complimentary usage, send transactional mail you ask for, and keep the Service reliable and secure. We do not sell personal information.

If you install the Belfry GitHub App, we receive installation and repository metadata needed to comment on pull requests you authorize. Access is limited to that installation. Uninstalling the App stops new GitHub-triggered scans.

We share data with named subprocessors that host infrastructure — Amazon Web Services (compute, database, object storage), GitHub (App installations), email delivery, Stripe when billing is configured, and identity or model providers you choose — under contract, and when required by law. The current list is described in our security pack and on the Security page. We do not share customer scan content with other customers. Tenants are isolated.

Account and workspace records remain while the tenant is active. You may request deletion of a tenant by contacting privacy@belfrylabs.ai. RDS backups in the hosted environment age out on a 7-day snapshot schedule. Complimentary scan counters are retained so a trial cannot be reset by rebinding an installation.

We use cookies and local storage that are necessary to sign you in and keep a session. See the Cookie Policy.

Depending on where you live, you may have rights to access, correct, or delete personal data we hold. Contact us to make a request. We will need to verify the account that owns the data.

The Service is hosted in the United States. If you access it from elsewhere, your information is processed in the US.

We will post updates on this page and change the date above. Material changes may also be noted in the product.