Privacy Policy

There are two distinct processing relationships here, and they matter:

• Account and website data. For the data we collect to run our business, our websites and customer accounts — user email addresses, account configuration, billing-related data — Distriib is the controller.
• Security telemetry and logs. For the logs and telemetry a Customer collects from its own endpoints, systems and networks using the Service, the Customer is the controller and Distriib acts as a processor, processing that data only on the Customer's behalf and instructions. That includes endpoint monitoring — process and command-line execution, and browser-visited URLs where the Customer opts in — which is monitoring the Customer is responsible for.

If you are an individual whose data appears in a Customer's logs — an employee, or the user of a monitored device — send your privacy request to that Customer, who is the controller. We will help them answer it as their processor.

Account and operational data (Distriib as controller)

• User account data: email address and a salted bcrypt password hash. We never store a plaintext password. Tenant and organization identifiers, and the user's role.
• Configuration metadata: tenants, users, devices, sources, detection rules, alerts, lists and similar settings.
• Support and communications: what you tell us when you contact us.
• Billing data: the service is invoiced by contract, with no payment processor inside the product; we hold the billing identifiers the invoice needs and no card numbers.
• Website data: the standard technical data a web request carries, such as an IP address and browser metadata. Our website sets no analytics cookies and loads no third-party trackers.

Security telemetry and logs (Customer as controller)

The logs collected through the Service may contain personal data, such as:

• source IP addresses, hostnames and device identifiers;
• usernames and account identifiers;
• process and command-line execution events;
• browser-visited URLs — only where the Customer opts in, which is off by default;
• AI coding-assistant activity on monitored devices — only where the Customer opts in, off by default: which model answered and how many tokens it used, which tools and MCP servers were called, the shell commands the assistant ran with secrets masked, and the configured MCP servers. Prompt and response text is never collected; a secret seen in a chat travels only as its type and a short fingerprint, never its value;
• WAF and HTTP access logs — IP addresses, user agents, requested URLs;
• any other security-relevant event content the Customer chooses to send.

The agent can redact secrets before a log leaves the host, and that is on by default. The Customer controls the optional collection switches and the retention window.

• Account and configuration metadata: a managed Postgres database hosted on Railway.
• Security logs: a Quickwit search engine over Cloudflare R2 object storage.
• Archived logs: a separate Cloudflare R2 bucket, only for tenants that turn cold storage on (see Data Retention).
• Application services: Railway.

The Sub-processors document has the full list.

For security telemetry, the lawful basis is chosen and documented by the Customer. Distriib does not decide the purposes or the means of processing that data.

We use third parties to deliver the Service. The Sub-processors document carries the maintained table — who they are, what they do and what data they see. At a glance: Cloudflare for log storage, Railway for hosting and the database, Resend for account and notification email, and GitHub where a Customer connects a rules repository.

The AI assistant runs on a model server Distriib operates itself; what you send it does not reach any third-party AI provider. The exception is a Customer that connects its own model — Anthropic, OpenAI, an OpenAI-compatible gateway or its own server — in the console: the features it picks then send their content to that provider, under the Customer's own account and agreement. That provider is engaged by the Customer, not by us, and is not our sub-processor.

The Service and its sub-processors may process data in countries other than your own, including outside the EEA and the UK. Where personal data is transferred internationally we rely on the safeguards the applicable law requires, such as the EU Standard Contractual Clauses and the UK Addendum, or an adequacy decision.

If you need the transfer mechanism and the data-importer details for a specific sub-processor, ask us at support@distriib.com and we will give you the current ones.

We keep personal data only as long as the purposes above need it, or as long as the law requires.

Security logs are kept for the window the Customer configures — 30 days by default, at least 1 day, and never more than the platform hard cap of 180 days. What happens at the end of that window depends on one switch the Customer owns: with cold storage off, which is the default, the logs are deleted; with it on, they are archived in compressed form and deleted 1 year after the event's own timestamp.

Account metadata lives until the account or the record is deleted. The full model, including how deletion actually happens, is in Data Retention.

GDPR and UK GDPR

Subject to applicable law you have the right to access your personal data; to rectify what is inaccurate; to request erasure; to restrict or object to processing; to data portability; and to withdraw consent where processing rests on it. You also have the right to complain to your supervisory authority.

CCPA and CPRA (California)

Subject to applicable law you have the right to know what personal information is collected, used and disclosed; to delete it; to correct it; to opt out of its sale or sharing; to limit the use of sensitive personal information; and to non-discrimination for exercising any of these. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

How to exercise them

• If your data is in a Customer's logs, contact that Customer, who is the controller. We support them as their processor.
• Where Distriib is the controller, write to support@distriib.com. We will verify the request and answer within the time the applicable law allows. You may use an authorized agent where the law permits it.

We apply technical and organizational measures appropriate to the risk: multi-layer tenant isolation, encryption in transit, signed agent updates that fail closed, secret redaction on the host, role-based access control and two-factor authentication. The Security Overview describes them. No method of transmission or storage is completely secure.

If a personal-data breach happens we act as the law requires. Where we are a processor we notify the affected Customer without undue delay, so that the Customer can meet its own obligations. Where we are the controller we notify the relevant supervisory authority and the affected individuals as the law requires.

The Service is built for businesses and is not directed to children. We do not knowingly collect personal data from children under the age applicable law sets — 16 under the GDPR, 13 under COPPA. If you believe a child's data reached us, tell us and we will delete it.

We may update this Policy. A material change is marked by updating the date at the top of this page and, where appropriate, by telling you directly.

• Distriib LLC — support@distriib.com
• San José, Costa Rica
• Privacy and data-protection contact: support@distriib.com