Privacy notice

Effective 2026-07-22

Who operates the service

guillaume.strohecker, 270 metro central heights se1 6bx london. Privacy contact: support@agentrisklayer.com.

Information we process

• Account email address, password hash, consent record and session records.
• Assessment answers, scores, reports, sharing settings and timestamps.
• Saved project risk profiles, architecture applicability outcomes, evidence-state links and versioned knowledge digests. Public profiler answers are not retained unless an authenticated user explicitly saves them to a project.
• Customer-authorised inspection and red-team summaries, redacted finding metadata, cryptographic integrity data and declared scope. The official tools are designed not to upload source code, raw prompts, target responses, credentials or matched secret values.
• Purchase, subscription and transactional-email references.
• Security and product events used to prevent abuse and operate the service.

Why we process it

We process this information to provide requested assessments and reports, perform the contract, secure accounts, fulfil payments, maintain records and improve service reliability.

Processors and optional analytics

Stripe processes live payments, subscriptions and billing. Resend delivers transactional email. The selected hosting provider stores and serves application data. Card details are not stored by AgentRiskLayer.

Google Analytics is optional and does not load until you accept analytics. If accepted, it processes usage events, page paths, device and approximate location information to help us understand and improve the service. We disable advertising signals and do not send form contents, credentials, assessment answers, prompts, source code or payment details. You can withdraw consent at any time by clearing the site preference in your browser and selecting “Reject optional analytics” on your next visit.

Sharing and public results

Assessments are private by default. A public summary and badge are exposed only after the account owner enables public sharing. Sharing can be disabled from the result page.

Retention and your controls

Account holders can download a structured data export and permanently delete their account from the dashboard. Billing records may need to be retained by payment providers or the operator where law requires it.

Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability or objection. Contact support@agentrisklayer.com. You may also complain to the relevant supervisory authority.

International processing and security

Processors may operate internationally under their own data-protection terms. We use salted password hashing, HTTP-only sessions, CSRF controls, access checks and encrypted HTTPS transport in production.

Changes

Material changes to this notice will be published with a revised effective date. Where required, account holders will also be notified directly.