Privacy Policy

Your agent data never leaves your account. The Xtrom enforcement plane runs inside your own cloud (VPC). Agent prompts, tool inputs/outputs, secrets, and the content agents process are evaluated locally and are not transmitted to or stored by Xtrom. We receive only privacy-scrubbed operational metadata (see §3).

2. Information you provide

• Account data — name, work email, company, role, and authentication identifiers when you sign up or are invited.
• Configuration — policies, entitlement rules, integration settings, and org/environment names you create.
• Communications — messages you send us (support, sales, security reports).

3. Information we collect automatically (privacy-scrubbed telemetry)

To operate the service and improve detection, our control plane receives metadata only — never raw customer data:

• Decision metadata: action type, verdict (allow / step-up / block), the layer that decided, latency, and a content-free reason code.
• Identity metadata: agent identifiers, entitlement names, and posture signals (e.g., "over-privileged").
• Product usage: pages viewed, features used, and diagnostic/error logs.

4. How we use information

• Provide, secure, and operate the platform and your account.
• Detect and prevent threats, and improve our detection models on de-identified data.
• Provide support, send service and security notices, and (where permitted) product updates.
• Meet legal, audit, and compliance obligations.

We do not sell personal information, and we do not use your data to train models that benefit other customers except as aggregated, de-identified threat intelligence.

5. Legal bases (GDPR)

Where GDPR applies, we process personal data under: performance of a contract, our legitimate interests (securing and improving the service), your consent (where required), and compliance with legal obligations.

6. Sharing & sub-processors

We share limited data with vetted sub-processors who help us run the service (e.g., cloud infrastructure, analytics, communications). Each is bound by confidentiality and data-protection terms. A current sub-processor list is available on request, and material changes are communicated in advance where required.

7. Data retention

Data	Retention
Account & configuration	For the life of your account, then deleted within 90 days of termination.
Decision/audit metadata	Per your configured retention (immutable WORM logs live in your environment).
Product/usage logs	Typically 12 months.

8. Security

We apply encryption in transit and at rest, per-tenant customer-managed keys (KMS), least-privilege access controls, and continuous monitoring. See our Trust & Security page for details, and report vulnerabilities to security@xtrom.ai.

9. International transfers

Where data is transferred across borders, we rely on appropriate safeguards (e.g., Standard Contractual Clauses). In-VPC deployment lets you keep processing within your chosen region.

10. Your rights

Depending on your location, you may have rights to access, correct, delete, port, or object to processing of your personal data, and to withdraw consent. To exercise these, contact hello@xtrom.ai. We respond within the timeframe required by applicable law.

11. Cookies

Our website uses essential cookies and privacy-respecting analytics. You can control cookies through your browser settings.

12. Changes

We'll update this policy as the product and law evolve, and revise the "last updated" date. Material changes will be communicated through the service or by email.

13. Contact

Questions about privacy: hello@xtrom.ai. Security matters: security@xtrom.ai.