Legal

Privacy & cookies

Kadense is a security product, so we hold ourselves to the posture we measure. This page states plainly what we do and don't keep. It is written to be read, not to be hidden behind. It is not a substitute for legal advice.

In summary

The whole page in one table. Detail follows below.

WhatDo we keep it?For how long

Your source code Never The extracted copy is destroyed when the run ends and the deletion is logged; your uploaded archive is deleted within 72 hours.

Supporting documents you attach Never Read for that single run and discarded. Only the filename is noted on the report.

Assessment reports Yes Scores, findings and their evidence quotes. Envelope-encrypted at rest.

Account & organisation data Yes While the account is active. Anonymised after a short grace period on deactivation.

Audit log Yes Tamper-evident and chained, so entries cannot be removed — only what the chain requires is retained.

Tracking & analytics cookies None Essential cookies only — session, CSRF, and your theme choice.

Code sent to the Anthropic API Yes Claude performs the assessment. Not trained on; deleted by Anthropic within 30 days by default. Every run records where its code went.

Sale or sharing of your data Never Not sold, not shared for advertising, not used to train models.

What we store — and what we never do

Your source code is not retained. When you run an assessment, your uploaded code is unpacked and scanned inside a single-use sandbox permitted to reach Anthropic and nothing else, and that extracted copy is destroyed as soon as the run ends. Your uploaded archive is held for up to 72 hours so a failed run can be retried, and is then deleted. After that we keep the report of the run — scores, findings and their evidence quotes — never the code itself.

The assessment itself is performed by Claude, so regions of your code are sent to Anthropic. This is the one part of a run that leaves our infrastructure, and it is what you agree to when you create an account:

Your code is sent to Anthropic to be assessed. The assessment is performed by Claude. Regions of your uploaded source code, and the text of any supporting documents you attach, are transmitted to Anthropic over TLS for that purpose. Where a run sent your code is recorded on that run's own page.
It is analysed in a single-use container in Microsoft Azure. We create a disposable container in Microsoft Azure (South Africa North region), place a copy of your uploaded files in storage attached to it, and permit it to reach Anthropic and nothing else. The container and that copy are destroyed when the run ends, and we verify and log the destruction. Microsoft Azure is a sub-processor for the duration of a run, and your code does not leave South Africa except to reach Anthropic.
Anthropic does not train on it. Inputs and outputs are not used to train models. The retention and training terms that apply are those of the Anthropic plan this deployment runs on, and the posture in force for your assessment is recorded with that run. Kadense does not grant any additional rights over your code.
Kadense does not keep your source code. The copy we extract to analyse is destroyed as soon as the run ends, and the deletion is logged. Your uploaded archive is held for up to 72 hours so a failed run can be retried, then deleted. After that we retain only the report — scores, findings and the evidence quotes supporting them — envelope-encrypted at rest. We never sell or share your data.
Only upload code you are entitled to have assessed. You confirm you own this codebase or are authorised to submit it for security assessment, and that you may lawfully disclose it to the third-party processors named above for that purpose.

Each assessment writes an egress manifest recording the provider, model and retention posture that run actually used — so this is verifiable per run rather than a promise on a page. An organisation may also point its runs at its own provider account, in which case that account's retention terms apply instead and the manifest says so.

Supporting documents are never retained either. If you attach evidence for a contextual re-assessment, we read its text for that single run and discard it — only the report notes which documents were provided. Nothing you upload persists past the run.

We do keep the account and operational data needed to run the service: your organisation and user record, assessment history and reports, billing records, and a tamper-evident audit log. Sensitive fields (including your email and report contents) are envelope-encrypted at rest.

Cookies we use

We use essential cookies only — there is no tracking, analytics, or advertising. Because they are strictly necessary to provide the service, they don't require opt-in consent; we tell you about them for transparency.

Session / authenticationKeeps you signed in securely after login.

CSRF tokenProtects forms against cross-site request forgery.

Theme & notice acknowledgementRemembers your dark/light choice and that you've seen this notice.

Your rights

Under POPIA (and GDPR where it applies) you can access, correct, or request deletion of your personal information, and object to its processing. When an account is deactivated we anonymise its personal information after a short grace period, keeping only what the tamper-evident audit record requires. To exercise any of these rights, contact us below.

Contact

Questions about your data, or a request to exercise your rights — email support@collabor8.ai.