Privacy Policy

Overview

TrustFix is operated by Vikavi Security LLC ("we", "us", or "our"), a Delaware limited liability company headquartered in the Greater St. Louis area, United States. This Privacy Policy explains how we collect, use, and protect information when you use TrustFix at trustfix.dev (the "Service").

We do not sell your data to third parties.

1. Information we collect

Account information: when you sign up, we collect your name, work email address, and organization name.

Cloud account data: when you connect a cloud account, we collect read-only identity metadata such as IAM role metadata, trust policies, and policy attachments. We never collect or store long-lived cloud access keys. All cloud access uses temporary credentials (for example, AWS STS) through a customer-created cross-account role.

Source-control data: when you connect a repository, we read CI/CD workflow files (for example, .github/workflows) and repository metadata. We do not read application source code.

Usage data: we collect logs of actions taken within the Service, including scans initiated, findings generated, and remediation pull requests created.

Payment data: payments are processed by our payment provider. We do not store full credit-card numbers on our servers.

2. How we use your information

We use the information we collect to:

• Provide the TrustFix scanning, attestation, and remediation Service.
• Generate AI-powered remediation recommendations using third-party AI providers.
• Send security finding alerts and product notifications.
• Improve detection accuracy and product features.
• Comply with legal obligations.

3. Data sharing

We do not sell your data. We share data only with service providers (sub-processors) who process it on our behalf — including cloud hosting, transactional email, payment processing, and AI inference providers. Each is bound by data-protection obligations. See our Sub-processors page for the current categories.

4. Data security

We use industry-standard security practices including encrypted connections (TLS), read-only cloud access, temporary credentials, strict tenant isolation, and audit logging of all actions. Your cloud account data is never accessible to other customers. We maintain a tamper-evident, append-only, cryptographically signed audit trail of every scan, finding, and remediation action. Our processing of personal data on your behalf is governed by our Data Processing Addendum, and your use of the Service by our Terms of Service.

5. Data retention

We retain your account data for as long as your account is active. Scan findings and audit logs are retained for 12 months by default. You may request deletion of your data at any time by contacting us.

6. Your rights

You may request access to, correction of, or deletion of your personal data at any time. To exercise these rights, email privacy@trustfix.dev. We will respond within the time required by applicable law, and in any event within 30 days where practicable.

7. Cookies

We use strictly necessary cookies for authentication and session management, and limited analytics cookies to understand usage in aggregate. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for details.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notice. Continued use of the Service after changes take effect constitutes acceptance.

9. Contact

Vikavi Security LLC, operating as TrustFix — a Delaware limited liability company, Greater St. Louis area, United States. For privacy inquiries, email privacy@trustfix.dev. For security inquiries, email security@trustfix.dev.