DevSecAI Privacy Policy

Last Updated: 21 June 2026

This Privacy Policy explains how DevSecAI ("we," "us," or "our") collects, uses, discloses, and protects your personal data when you visit our website, devsecai.io, engage with our services, or otherwise interact with us.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws.

Who We Are

DevSecAI Limited builds Arko, a security platform that helps engineering teams find and fix risk in their code. DevSecAI Limited is registered in England and Wales (company no. 16127905).

For the purposes of UK GDPR, DevSecAI is the data controller responsible for your personal data collected via our website and services.

 Personal Data We Collect

We may collect and process the following types of personal data about you:

  • Identity Data: Includes first name, last name, title, and potentially your job title and company name.

  • Contact Data: Includes billing address, delivery address, email address, and telephone numbers.

  • Technical Data: Includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.

  • Usage Data: Includes information about how you use our website, products, and services.

  • Marketing and Communications Data: Includes your preferences in receiving marketing from us and our third parties and your communication preferences.

  • Inquiry and Interaction Data: Information you provide when you contact us through forms on our website, email, phone, or social media, including details of your inquiries about our services.

  • Event/Webinar Registration Data: Information you provide when signing up for our events, webinars, or community groups (e.g., name, contact details, company, role).

How We Protect Your Information

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

How We Collect Your Personal Data

We collect personal data through direct interactions (when you contact us, request a demo, subscribe or sign up to Arko), automated technologies (cookies and server logs, see our Cookie Policy), and third parties such as analytics providers like Google and professional networks like LinkedIn.

How and Why We Use Your Personal Data

We use personal data only where the law allows, relying on one or more of performance of our contract with you, our legitimate interests in operating securing and improving our website and products and marketing our services, compliance with a legal obligation, and your consent for marketing and non-essential cookies which you can withdraw at any time.

Arko Service Data

Where your organisation uses Arko, DevSecAI processes data on your organisation's behalf as a processor, under your customer agreement and Data Processing Agreement. Arko comprises a free IDE plugin and Arko Enterprise (the Control Plane, with advanced repository and CI/CD scanning). In the IDE plugin, code snippets are analysed in transit and your files are not retained. Repository and CI/CD ("build") scans are an Arko Enterprise capability: submitted source is processed inside your isolated, encrypted tenant solely to produce findings and is automatically deleted on scan completion. We keep only derived security evidence (findings, SBOM, scores) and short, secrets-redacted per-finding code excerpts; we do not retain your full source after the scan, and never use your code or data to train AI models. All production infrastructure runs on AWS in London (eu-west-2); AI inference runs on private EU model hosting via Amazon Bedrock and is not shared with the model provider. Data is encrypted in transit and at rest.

Who We Share Your Data With

We only share limited personal data only as needed and under appropriate safeguards, with our subprocessors Amazon Web Services (hosting and AI inference via Bedrock), Vanta (security and compliance monitoring) and Google Workspace (business email and productivity), and with professional advisers and authorities where required. Our current subprocessor list is on our Trust Center at https://trust.devsecai.io.

International Transfers

Where personal data is transferred outside the UK, we ensure adequate protection through a UK adequacy regulation, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses. Production data for Arko is hosted in the UK (eu-west-2).

Data Security

We maintain extensive technical and organisational measures, including advanced DevSecOps processes, encryption in transit and at rest, access controls and monitoring, and limit access to those with a business need. We are completing a SOC 2 Type II report, and our current posture is published on our Trust Center.

Data Retention

We retain personal data only as long as necessary for the purposes we collected it, including legal, accounting and reporting requirements. For Arko, your source is deleted on scan completion and is not retained; the derived security evidence we generate (findings, SBOM, scores) is kept while your organisation's account is active, or as set out in your customer agreement, then deleted or anonymised.

Your Legal Rights

Under UK GDPR you have the right to access, correct, erase, restrict or object to processing, to data portability, and to withdraw consent. To exercise any right, contact info@devsecai.io. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Cookies

Our website uses cookies. See our Cookie Policy for detail and controls.

Changes to This Policy

We review this policy regularly. The current version is dated at the top of this page.

Contact

DevSecAI Limited (company no. 16127905), info@devsecai.io. Our security posture and documentation are available at https://trust.devsecai.io.