Privacy Policy

1. Who we are

SecAI is operated by Tech Steps LLC, licensed in Sharjah Media City, United Arab Emirates ("we", "us"). This policy explains what data we collect through the SecAI platform and agent, why we collect it, who we share it with, and what rights you have over it.

For questions about this policy or to exercise any of the rights described below, contact us through the Contact page.

2. Data we collect

Account data

When you register we collect your name, email address, organisation name, and a hashed password. If you subscribe to a paid plan we also process billing records. We never see or store full payment card details - these are handled by our payment provider.

Server telemetry

The SecAI agent runs on servers you choose to monitor and transmits operational and security data, including:

• Hostname, operating system, distribution version, and agent version
• System metrics such as CPU, memory, disk and uptime
• Installed package names and versions, used for vulnerability matching
• Cryptographic hashes and paths of monitored files, for integrity checking. When a persistence file changes (a cron entry, sudoers, an authorized_keys file, a systemd unit), the text before and after the change is sent as well, within a small size limit and never for binary files
• Security events, including authentication failures, source IP addresses of detected attacks, blocked addresses, process and listening-port information, and outbound connection metadata
• Configuration state relevant to security posture, such as SSH settings

The agent is designed to transmit security-relevant metadata. It does not read, collect or transmit the contents of your application databases, user files, or customer records stored on the monitored server. The one exception is described in section 4: when the scanner flags a file as suspicious, a short excerpt of that file is sent for screening.

Usage data

We record logins, actions taken in the dashboard, and API access for security and audit purposes.

3. How we use data

• To detect, alert on and respond to security threats on your servers
• To generate AI-assisted security audits, risk scores and remediation guidance
• To match installed packages against public vulnerability databases
• To send you alerts, reports and service notifications
• To provide, bill for and support the service
• To investigate abuse of the platform and meet legal obligations

We do not sell your data, and we do not use your data for advertising.

4. AI processing and sub-processors

SecAI uses OpenAI to analyse security data and to write findings in plain language. This happens in five places: the security audit you run on a server, re-checking a finding you have told us you fixed, a safety check before a one-click fix is queued, screening files the web-shell scanner has flagged, and the in-app assistant.

File screening is the one that runs without you asking: when the scanner flags a file, its path, size, cryptographic hash and first 200 bytes are sent for a verdict. A file that matches its publisher's published checksum is never sent at all. Everything else sent to OpenAI is security data about your servers - findings, package versions and configuration state. This involves transfer of data to the United States, outside the European Union where the platform is hosted.

The third parties we rely on are:

We also download public vulnerability data from CISA, FIRST, Wordfence and WordPress.org. These are one-way downloads and carry nothing about you, except when we verify a plugin against its publisher, which sends that plugin's name and version and nothing else.

If your organisation's data residency requirements prohibit AI processing in the United States, an administrator can turn AI processing off for your organisation in its settings; nothing is then sent to OpenAI. Contact us if you need to discuss anything else about where data is held.

5. Where data is stored

Platform data, including account records, telemetry, incident history, backups and application logs, is stored on a server in France (European Union) that we operate, provided by Contabo GmbH. If your organisation is outside the European Union, for example in the United Arab Emirates, your platform data is therefore held outside your country. Data transmitted to the sub-processors listed above is processed on their infrastructure under their own terms and security controls.

6. Retention

• Incident and security event history is retained according to your subscription plan
• Audit reports are retained for the life of the account unless you delete them
• Conversations with the in-app assistant are kept for 180 days from the last message, then deleted. A conversation you escalated to a person is kept, so the request for help is not lost
• Records of what each AI call cost - the feature, model and token counts, never the content - are kept for a year
• Account and billing records are retained as required for legal and accounting purposes
• On account closure, we delete or anonymise platform data within 90 days, except where retention is legally required

7. Security

We use encrypted transport for all agent and dashboard communication, hash stored passwords and API keys, enforce organisation-level data isolation between tenants, and restrict internal access to production data. No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your data, we will notify you without undue delay.

8. Your rights

Subject to applicable law, including the UAE Personal Data Protection Law, you may request access to the personal data we hold about you, correction of inaccurate data, deletion of your data, restriction of or objection to certain processing, and a copy of your data in a portable format. You may also withdraw consent where processing is based on consent.

To make a request, use the Contact page and choose "Privacy or data request". We will respond within the period required by applicable law.

9. Your responsibilities

You are responsible for ensuring you have the right to install the SecAI agent on the servers you monitor, and for informing anyone whose personal data may appear in that telemetry, where required by law. If you monitor servers on behalf of your own clients, you are responsible for the appropriate agreements with them.

10. Cookies and analytics

In the dashboard we use strictly necessary cookies and local browser storage to keep you signed in and to remember interface preferences such as theme and language. No analytics or advertising scripts run inside the dashboard.

Our public website is different. It loads Google Analytics, which sets its own cookies and tells Google about your visit, and a self-hosted Umami analytics script, which is cookieless. Page fonts are served by Google Fonts, so Google receives your IP address when a page loads. We do not use advertising cookies anywhere.

11. Children

SecAI is a business product and is not directed at anyone under 18. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy as the service changes. Material changes will be communicated to account holders by email or through the dashboard, and the date at the top of this page will be updated.

13. Contact

Tech Steps LLC
Sharjah Media City, United Arab Emirates
secai.techsteps.ae/contact