Legal
Privacy
Placeholder pending legal review. The substance below is accurate; the wording is not yet a contract.
What we collect
Two distinct categories, held to different standards. Account data — names, work email addresses, and workspace membership — is what you give us to use the product. Evidence is what you connect or provide for an investigation: source code, commits and pull requests from GitHub repositories you select; log entries from Google Cloud Logging sources you define; Jira Cloud tickets you link to an incident, with their comments and attachments; files you attach; and, if you install the optional Windows agent, directory listings, file contents and Windows Event Log records from the sources configured on that host.
Current boundary
Decim reads evidence with read-only access, except that its GitHub App can open a draft pull request when a user asks it to. It does not connect to your databases or run SQL. Evidence is processed by a third-party language-model provider, and neither the service nor the optional Windows agent redacts it, so do not connect sources that carry secrets or unnecessary personal data.
Retention
Raw results returned by the Windows agent are deleted 3 days after an incident is closed, and incident attachments 7 days after. The excerpts a finding cites, the incident record and its reports are kept with the workspace so the conclusion stays checkable. These windows are fixed during the pre-release pilot. You can request workspace deletion at any time.
Sub-processors
Sub-processors include the cloud provider that hosts the service and its storage, and the third-party language-model provider that processes evidence during an investigation. A current list is available on request and will be published here before general availability. We do not sell data, and we do not use customer evidence to train models shared with other customers.
Contact
Questions about this policy, or a data subject request: privacy@decim.dev.