EdgeBreach Privacy Policy

Last updated: October 15, 2026

This Privacy Policy explains how EdgeBreach, Inc. (“EdgeBreach,” “we,” “us”) collects, uses, shares and protects information when you visit edgebreach.com, use the EdgeBreach platform at app.edgebreach.com, or otherwise interact with us (together, the “Service”).

EdgeBreach is a business-to-business service. We sell to companies, agencies and other organizations, and our accounts are for people using the Service for work. The Service is not intended for personal, family or household use.

The short version

We test only what our customers authorize, and we record who authorized each test.
We do not keep your source code. When you connect a repository, we analyze the code in a temporary environment and keep only metadata about it, such as file paths, endpoints and findings.
Our core testing model runs in our own AWS environment. It is a proprietary model we trained on an open-weight foundation model. The data it processes is not sent to that foundation model’s developer.
We use Anthropic’s Claude models to help assemble reports. Under Anthropic’s commercial terms, Anthropic does not use that data to train its models.
We learn from proven vulnerabilities, but only after removing anything that identifies you, your clients, your targets or any individual. We never train on your source code or credentials.
We do not sell personal information, and we do not use it for targeted advertising.
Your data is hosted in the United States.

1. Our role

When we act for ourselves. For information about our own customers, prospects, website visitors and account users (for example, your name, work email and how you use our website and app), EdgeBreach decides how the information is used. This Privacy Policy describes those practices.

When we act for our customers. When a customer uses the Service to test its applications and systems, the data in and about those systems belongs to that customer (or to the customer’s clients). This includes target configurations, findings and evidence, and any personal information that happens to be in the systems being tested. We process that data on the customer’s behalf, under our agreement with them, and only to provide the Service. If you are an end user of an application one of our customers tested and you have a question about your information, please contact that customer directly. We will help them respond.

2. Information we collect

2.1 Information you give us

Account and contact information: name, work email address, company, job title and phone number. Accounts require a business email address.
Billing information: billing contact, plan and payment history. Payment card details are collected and stored by our payment processor, Stripe. We do not store full card numbers.
Communications: messages you send us, support requests, demo and meeting requests, survey responses and feedback.
Marketing preferences: for example, if you subscribe to our updates.

2.2 Testing configuration

To run tests, customers provide:

Targets and scope: domains, URLs, IP addresses, hosts, environments and scan settings.
Authorization records: a record that a user confirmed they are authorized to test each target, including the user, time and scope.
Credentials for authenticated testing: usernames and passwords, tokens, API keys or OAuth client details for the applications you ask us to test. We encrypt these, and we use them only to run the tests you configure.
Integration connections: for example, the GitHub App installation that lets us read repositories you select, and connections to tools such as Jira or Slack.

2.3 Source code

If you connect a repository for source-assisted (“white-box”) testing, whether through our GitHub App, a public repository URL or an upload, we analyze the code in a temporary processing environment. We do not store or retain copies of your source code. What we keep is metadata derived from the analysis, such as file paths and line numbers, routes and endpoints, function and component names, dependency names and versions, how data moves through the application, and the resulting findings. We do not use your source code to train any model.

2.4 Testing results

The Service generates and stores the results of the testing you authorize, including:

findings, severity ratings, confidence levels and remediation guidance
evidence of exploitability, such as HTTP requests and responses, screenshots, timing data and attack paths
reports, including compliance-oriented reports

Evidence comes from the systems you ask us to test, so it can sometimes include information stored in those systems, which may include personal information. Our testing safeguards are designed to minimize this. When exposure of data has to be demonstrated, we collect small, redacted samples rather than bulk data.

2.5 Information collected automatically

Usage information: pages and features you use in the app, actions you take, and when you take them. We use Mixpanel for product analytics.
Device and log information: IP address, browser and device type, operating system, referring pages, timestamps, and error and performance data.
Security logs: sign-in activity and other records we keep to protect accounts and the Service.
Cookies and similar technologies: see Section 7.

2.6 Information from other sources

Sign-in and identity providers: our authentication provider (Auth0) confirms your identity when you sign in.
Integrations you connect: for example, repository and organization metadata from GitHub.
Payment processor: payment status and billing details from Stripe.
Partners: agencies, resellers, referral partners and program partners that introduce you to us or manage an account on your behalf.
Business contact sources: publicly available sources and business-contact data providers we use to identify and contact potential customers.

3. How we use information

We use information to:

Provide the Service: create and manage accounts, run the tests you configure, generate findings and reports, and provide support.
Protect the Service and others: verify authorization, enforce testing safeguards, prevent fraud and abuse, investigate suspected misuse, and keep the Service secure.
Bill you: process payments, manage subscriptions and keep financial records.
Communicate with you: send service notices (for example, test completion, security alerts and account or billing notices) and respond to requests. With your permission, or as the law allows, we also send product updates and marketing, which you can opt out of at any time.
Improve the Service: understand how features are used, fix problems and develop new capabilities.
Train and improve our models: as described in Section 4.
Meet legal obligations: comply with law, respond to lawful requests, and establish or defend legal claims.

4. AI and model training

4.1 Our testing model

EdgeBreach’s testing is driven by a proprietary reasoning model that we trained for software vulnerabilities, built on an open-weight foundation model. We host it in our own Amazon Web Services environment. It currently runs on Amazon SageMaker, and we may move it to Amazon Bedrock. The data our model processes stays in our AWS environment and is not sent to the developer of the underlying foundation model.

4.2 Third-party AI for reports

We use Anthropic’s Claude models, through Anthropic’s commercial API, to help assemble test reports. To do this, we send Anthropic the finding details and evidence needed for the report. We do not send your source code. Under Anthropic’s commercial terms, Anthropic does not use this data to train its models, and it keeps the data only for a limited period. If we add or change AI providers, we will update this policy.

4.3 How we learn from testing

We improve our models using information about vulnerabilities the Service has proven. This information includes the type of vulnerability, the technique used, how the application responded, and whether exploitation succeeded. Before we use this information for training, we remove anything that identifies a customer, a customer’s client, a target or an individual, including names, domains, URLs, IP addresses, credentials and personal information. We never use source code or credentials for training. We do not try to re-identify this de-identified data, and we do not sell it. Because it no longer identifies anyone, we may keep it after an account ends.

Customers who need their data excluded from model training can arrange this in an order form. Contact us at sales@edgebreach.com.

4.4 Review of AI outputs

We do not use AI to make decisions about individuals that have legal or similarly significant effects. AI-generated content, such as report text and suggested fixes, can contain errors and should be reviewed before you rely on it.

We do not sell personal information, and we do not share it for cross-context behavioral (targeted) advertising. We share information only as follows.

5.1 Service providers

We use service providers to run our business and the Service. They may use the information only to provide their services to us. Our current principal providers are:

Amazon Web Services: cloud hosting, storage, encryption key management, and hosting of our testing model (US regions)
Anthropic: AI models that help assemble test reports
Auth0 (Okta): sign-in and authentication
Stripe: payment processing and billing
Google Workspace: business email, calendar and documents
HubSpot: customer relationship management and sales and marketing email
Mixpanel: product analytics
Website, scheduling and video tools: website hosting and forms (currently Webflow, with Cloudflare Turnstile for spam and bot protection), meeting scheduling, and recorded video walkthroughs (Loom)

5.2 At your direction

We share information when you direct us to, for example:

with the integrations you connect, such as GitHub, Jira or Slack
with other users in your organization’s account
with an agency, consultant or managed service provider that manages your account or tests your systems for you
when you or your agency share reports with clients, auditors or assessors

5.3 Program partners

If you join EdgeBreach through a program offered with a partner, such as an investor, accelerator or industry group, we share only aggregated results that do not identify you with that partner, unless you agree otherwise.

5.4 Legal and safety

We may disclose information if we believe in good faith that it is required by law, subpoena or other legal process, or that it is needed to protect the rights, property or safety of EdgeBreach, our customers or others. This includes investigating or preventing testing that was not authorized. Where the law allows, we will tell the affected customer about government requests for its data.

5.5 Business transfers

If we are involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy.

We may share information for other purposes with your consent.

6. Data location

We host the Service in Amazon Web Services’ United States regions. We and our service providers store and process information primarily in the United States.

7. Cookies and analytics

Website. Our website uses cookies and similar technologies that are needed to run the site, protect forms from spam and bots (Cloudflare Turnstile), and load fonts (Google Fonts, which receives your IP address when fonts load).

App. The app uses cookies needed for sign-in and security, and Mixpanel for product analytics, which records how features are used.

Email. Our marketing emails may use standard tracking to show whether a message was opened or a link was clicked.

We do not use advertising or retargeting cookies. You can control cookies in your browser settings, but blocking necessary cookies may stop the app from working. Because we do not sell or share personal information for targeted advertising, browser privacy signals such as Global Privacy Control do not change how we handle your information. If that changes, we will honor them as required by law.

8. How long we keep information

We keep information only as long as we need it for the purposes in this policy:

Account and contact information: while your account is active, and afterward as needed for legal, billing and record-keeping purposes.
Customer data: target configurations, findings, evidence, reports and code metadata are kept for the life of the subscription. After a subscription ends, customers have 30 days to export their data. We then delete it within 90 days after the subscription ends. Copies in backups are overwritten through our regular backup rotation.
Credentials for authenticated testing: until you delete the credential set or your account ends, whichever comes first.
Free trials and pilots: 30 days after the trial or pilot ends, unless you become a paying customer.
Authorization records and security logs: as long as reasonably needed to protect the Service and to establish or defend legal claims, generally up to three years after an account ends.
Billing records: as long as tax and accounting laws require.
De-identified training data: may be kept indefinitely (see Section 4.3).

We may keep information longer when the law requires it, or to resolve disputes or enforce our agreements.

9. Security

We protect information with administrative, technical and physical safeguards appropriate to a security company. These include encryption in transit and at rest, encrypted storage of testing credentials, logical separation between customer accounts, access controls that limit our personnel to what their role requires, and multi-factor authentication for administrative access. No system is perfectly secure. If we learn of a security incident that affects your information, we will notify affected customers without undue delay and as the law requires.

To report a vulnerability in EdgeBreach itself, email security@edgebreach.com.

10. Your choices and rights

Account information: you can view and update most account information in the app.
Access, correction and deletion: you can ask us to provide, correct or delete personal information we hold about you. Email privacy@edgebreach.com. We will verify your request and respond within 45 days. If your information is part of a customer’s data (see Section 1), we will pass your request to that customer or help them respond.
Marketing emails: you can unsubscribe using the link in any marketing email. We will still send service and account notices.
State privacy rights: depending on where you live, U.S. state privacy laws may give you additional rights, such as the right to know what we collect, to correct or delete it, and to opt out of sales, targeted advertising or profiling. We do not sell personal information, use it for targeted advertising, or profile people in ways that produce legal or similarly significant effects. We will honor reasonable requests to exercise these rights wherever you live. If we decline a request, you may appeal by replying to our decision, and we will review it.
Non-discrimination: we will not treat you differently for exercising your privacy rights.

11. International users

The Service is offered to organizations in the United States. It is not directed to individuals in the European Economic Area, the United Kingdom or Switzerland. If you use the Service from outside the United States, your information will be processed in the United States.

12. Children

The Service is for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.

13. Third-party sites and services

The Service may link to, or integrate with, third-party websites and services such as GitHub, Jira and Slack. Their own privacy policies govern how they handle your information.

14. Changes to this policy

We may update this Privacy Policy. When we do, we will change the “Last updated” date. If we make material changes, we will notify customers by email or in the app before the changes take effect.

15. Contact us

EdgeBreach, Inc.
5255 Winthrop Avenue, Suite 135
Indianapolis, IN 46220

Privacy questions and requests: privacy@edgebreach.com
Security and vulnerability reports: security@edgebreach.com