Trust & Security

An endpoint scan calls the agent at the URL you configure. You submit the endpoint, the request shape, tool definitions, an optional description, and optional encrypted credentials. The agent's own instructions stay on the agent. We do not receive them unless the agent repeats them during the scan.

A runtime scan runs through your own process. You submit the agent's instructions, tools, and metadata so the scan can replay them. A skill scan receives the skill source or an uploaded archive.

The report keeps the score, findings, the attack transcript, and tool calls. Credential-shaped values and a planted canary are removed from those records. Anything else the agent says, including a leaked instruction, can remain in the transcript and in a finding. Current scans do not replace stretches of a submitted prompt with a redaction marker. Hosted scans that accepted a pasted system prompt are no longer offered.

Runtime-scan instructions stay on the scan, with credential-shaped values removed when the scan finishes, until the retention window below. The messages exchanged during the scan are cleared from the event log when the scan finishes.

Saved endpoint configurations keep the URL, tool definitions, and encrypted credentials until you remove the agent.

We do not use your prompts or agent content to train foundation models.

A Shield API request log records the date, the time the request finished, and the classification score. It does not contain the text you sent, and it is deleted after 30 days. On a free plan, the free Shield model may store a redacted excerpt of a flagged request when you agreed to that at key creation, for up to 12 months. Paid plans do not store that text.

Scores, findings, recommendations, and remediation stay for the life of the account.

A daily job deletes older conversation transcripts, tool logs, campaign checkpoints, uploaded skill archives, and runtime-scan instructions. The window is 365 days. Business and Enterprise plans can choose 30, 90, or 180 days in Settings → Security → Data retention.

While a scan is running, Cloudflare Workflows keep the job, which can include probe messages and agent replies. Our database copy of that launch payload is removed once the worker accepts the job. Cloudflare keeps its own workflow history.

We also keep, inside your account or workspace, attack prompts our engine wrote and a short record of the defenses we observed. Those records are not a copy of your agent's instructions.

Email support@zeroleaks.ai to delete scan data. We then delete prompt scans, endpoint scans, runtime scans, skill scans, their reports, skill archives, and campaign checkpoints for that account. That deletion leaves the user profile, saved agent configurations, learned attack prompts, and defense fingerprints in place. Say so in the request if you want those removed too.

Cloudflare hosts the application, runs scan workflows, isolates sandbox containers, and stores uploaded files. Convex stores the application database. Anthropic, Microsoft Azure, and OpenRouter run the models that attack and judge scans, and they receive the scan content needed for that call. Stripe and Autumn handle billing. Resend sends transactional email.

With your consent, PostHog receives product-usage events that do not include scan contents. Intercom loads the support messenger after you allow support cookies. Sentry receives error diagnostics when error reporting is enabled. Upstash stores rate-limit counters. GitHub receives the profile from GitHub sign-in. Requests to zeroleaks.io are redirected by Vercel.

Each provider receives the data required for its function.

Authentication supports passkeys and two-factor authentication. Sessions are scoped per device and can be revoked.

Traffic to the service uses TLS. Integration secrets, planted canaries, and customer API keys are encrypted with AES-256-GCM before we store them.

Behavioral tool testing runs in an ephemeral Cloudflare Sandbox container. Model-controlled file operations, commands, and configured outbound requests are isolated and recorded for the report, and the container is destroyed after each scan batch.

We do not have a SOC 2 report. We are preparing for one. A security questionnaire is available to enterprise customers under a non-disclosure agreement.

A data processing addendum is not published on this site. Paid customers can request one at support@zeroleaks.ai.