Privacy policy — DRAFT
DRAFT. Not reviewed by a lawyer. Not published. Written so that a lawyer reviews something that knows how the product works.
Ruah Tech Solutions (ABN 73 147 792 774) operates SecureFlow. Contact: privacy@ruah.ai
What we collect
From you: your name, email address, organisation name, and country. Your role. Nothing else — we have no field for a date of birth, a phone number, or anything the Privacy Act calls sensitive information.
From your systems, because you asked us to scan them: source code, dependency manifests, cloud configuration, and the responses of endpoints you authorised us to send traffic to. This is the bulk of what we hold and most of it is not personal information — but it can contain some, incidentally, if your code does.
Automatically: IP address, browser, and what you did in the product, in an audit log that exists so you can see who did what in your own organisation.
What we do with it
Run the service. That is the whole list.
- We do not sell it.
- We do not use it for advertising.
- We do not use your code or your findings to train anybody's model, including ours.
- We do not share it with another customer, and the database enforces that rather than trusting our own code to.
Where it is
Australia — ap-southeast-2, Sydney. Backups stay in Australia.
One exception, and we would rather state it than bury it: generating a fix proposal or a summary sends the relevant code and findings to a model provider. We are choosing between a provider that keeps the request inside Australia and one that does not, and this policy will name which before the feature is generally available.
Who else touches it
docs/security/SUB-PROCESSORS.md, versioned in our source repository so a change is a commit with a date rather than a page that quietly differs from the one you read. You are told before a new one starts handling your data.
How long we keep it
| What | How long |
|---|---|
| Account and profile | While your account exists, then 30 days. |
| Findings, scans, fixes | While your account exists, then 30 days. |
| Audit log | 90 days to 7 years, by plan. |
| Proofs of Fix | Kept — they are evidence you may need years later. |
| Support tickets | 2 years. |
What you can do
- See it. Export everything, machine-readable, without asking us.
- Correct it. Your profile and organisation details are directly editable.
- Delete it. Delete your organisation. You see exactly what will go before you confirm, and it is irreversible afterwards.
- Complain. privacy@ruah.ai first. If we do not resolve it, the Office of the Australian Information Commissioner — oaic.gov.au — and we will not treat going to them as a hostile act.
If something goes wrong
We assess a suspected breach immediately, not at the end of the 30 days the Privacy Act allows. Where a breach is likely to result in serious harm we notify you and the OAIC. Our incident process requires a statement about customer data before an incident can be closed, so the question cannot be quietly skipped.
Changes
Material changes are notified in the product and by email before they take effect.
Drafting notes for the lawyer:
- APP 5 requires notification at or before collection — the registration form needs a line and a link, which is a product change not a policy one.
- APP 8 accountability for the overseas model provider turns on the decision noted above; the clause should probably survive either choice.
- APP 4: a scan may incidentally collect personal information from inside a customer's code. We redact credentials but do not detect or redact personal information, and this should say so explicitly.