Privacy Policy

1. Introduction

Cyphrex ("we," "our," or "us") provides AI agent security and identity infrastructure. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services at cyphrex.io.

2. Information We Collect

Account Information

• Email address
• Name (if provided)
• Company name (for paid plans)
• Billing contact name, company name and billing address, used to issue invoices

Agent Monitoring Data

• Agent IDs and names
• API keys (encrypted)
• Behavior profiles and safety packages applied
• Audit logs: action types, timestamps, API endpoints called, spend amounts
• Action payloads, truncated to 2048 characters, only where payload capture is explicitly enabled for an agent
• Alert configurations and delivery preferences
• Prompt injection detection results

Automatically Collected Information

• IP addresses
• Browser type and version
• Device information

2.5 Blockchain identity data (Blockchain SSN)

If you enable optional Blockchain SSN (on-chain agent identity on Solana), we may collect and process:

• Blockchain SSN identifiers (on-chain public addresses / PDAs)
• Wallet addresses (for self-custody users)
• Transaction signatures submitted for verification or registration workflows
• On-chain action counts and related metadata mirrored or derived from public blockchain data

Important: Much of this blockchain data is public and immutable. Once registered on Solana, agent identity information may be permanently visible to anyone. We cannot delete data from the Solana blockchain; we can only delete or update our internal database records that link your account to on-chain identities.

3. How We Use Your Information

• Provide and maintain the Cyphrex service
• Monitor AI agent actions and enforce behavior profiles
• Generate audit logs and compliance reports
• Send alerts when violations are detected
• Issue and manage invoices
• Detect known injection patterns, including encoded and obfuscated variants
• Improve our security detection algorithms using aggregate violation metadata, excluding customer action payloads
• Communicate product updates and security notices
• Comply with legal obligations

4. Data Retention

We retain your data according to your subscription tier:

• Sandbox: 30 days of audit logs
• Core and Design Partner: 1 year of audit logs
• Scale: 3 years of audit logs
• Enterprise: Custom retention (as contracted)

Account information is retained until you request deletion. Deleted data is permanently removed within 30 days, except where retention is required by law.

Blockchain data retention

On-chain blockchain data is immutable and permanent. We cannot delete data from the Solana blockchain. We can delete our database records linking your account to blockchain identities; the blockchain SSN and related on-chain records may remain publicly visible indefinitely.

5. Information Sharing and Disclosure

Sub-processors

We use the following third-party service providers:

Only Merkle root hashes are written on chain. No customer content, payload data, or personal data is published to the blockchain.

Website analytics

These providers receive marketing website visitor data only and have no access to Service data or audit records.

We Do Not Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We do not share your agent monitoring data with anyone except as required to provide the service.

Legal Requirements

We may disclose your information if required by law, subpoena, or court order, or to protect our rights, property, or safety.

6. Your Rights

CCPA Rights (California Residents)

• Right to know what personal information we collect
• Right to delete your personal information
• Right to opt-out of sale of personal information (we don't sell data)
• Right to non-discrimination for exercising your rights

GDPR Rights (EU Residents)

• Right to access your data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing
• Right to restrict processing

To exercise any of these rights, email hello@cyphrex.io. We will respond within 30 days.

7. Data Security

We implement industry-standard security measures:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• API keys stored encrypted with per-user keys
• Role-based access control
• Regular security audits and penetration testing
• SOC 2 Type II certification (in progress)

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Blockchain identity services disclaimer

Blockchain SSN features are provided "as-is" without warranty of any kind. To the maximum extent permitted by law, Cyphrex shall not be liable for:

• Lost or stolen private keys
• Blockchain network failures or outages
• Irreversible transactions
• Smart contract vulnerabilities
• Loss of access to blockchain identities
• Any damages arising from blockchain features

Maximum liability for blockchain services: fees you paid in the past 12 months for Blockchain SSN features only.

8. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses for EU data transfers.

9. Children's Privacy

Cyphrex is not intended for users under 13 years of age. We do not knowingly collect information from children under 13. If you believe we have collected data from a child, contact us immediately at hello@cyphrex.io.

10. Do Not Track

We do not currently respond to "Do Not Track" signals. We do not track users across third-party websites.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or prominent notice in the dashboard. Continued use after changes constitutes acceptance.

Blockchain SSN (self-custody)

All Blockchain SSN registrations use self-custody. You own and control your agent's private keys and wallet. Cyphrex never holds, accesses, or manages private keys. Cyphrex may cover Solana gas fees on paid plans as a convenience. Blockchain transactions are irreversible. Cyphrex is not responsible for lost wallet access, network failures, or irreversible transactions.

12. Contact Us

For privacy-related questions or to exercise your rights:

Email: hello@cyphrex.io
Mailing address: Available upon request from hello@cyphrex.io.