Trust & Security
How we protect your data and your generated code.
Encryption
- • TLS 1.3 in transit
- • AES-256 at rest
Hosting
- • Microsoft Azure — West Europe region (Amsterdam)
- • On-premise deployment available on Enterprise plan
Data retention
- • Generation artifacts: 30 days (last 3 versions per source)
- • User account data: until explicit deletion upon request
- • Source code analyzed during generation: not stored — processed in-memory only
LLM access
- • Hosted service: we send data to the Anthropic API (Claude) at three steps — enrichment (the source's title and description, and each tool's name, description and parameters), then evaluation and correction (the generated server code)
- • Anthropic keeps these inputs and outputs according to its commercial data retention policy: How long do you store my organization's data? We have no zero data retention agreement with Anthropic.
- • Enterprise:
--no-llmmode — no external LLM calls at all - • Enterprise: on-premise LLM option (Llama, Mistral via self-hosted endpoint)
Compliance
- • GDPR compliant — DPA available on request
- • SOC 2 Type I — planned, timeline TBD
- • ISO 27001 — planned, timeline TBD
Subprocessors
Third-party services that may process data on our behalf:
| Provider | Purpose | Location |
|---|---|---|
| Microsoft Azure | Hosting, compute, database | EU West (Amsterdam) |
| Anthropic | LLM enrichment of tool descriptions, evaluation and correction of generated servers (see LLM access) | US |
| Resend | Transactional email (password reset, account messages): your email address and the message | EU (Ireland) |
| Cloudflare | DNS for our domains; routing of emails sent to our @vulcai.io addresses | Global network |
| api-adresse.data.gouv.fr | Address autocomplete for French addresses in account settings: the address text you type, sent from our servers | France |
| Nominatim (OpenStreetMap Foundation) | Address autocomplete for other countries: the address text you type and the country code, sent from our servers | UK |
Enterprise plans can opt out of Anthropic with --no-llm mode or on-premise LLM.
Loaded by your browser
Our pages load these resources directly from third-party servers, which therefore see your IP address:
- • cdn.tailwindcss.com — page styles, on every page
- • flagcdn.com — country flags in account settings
Contact
- • Security enquiries: security@vulcai.io
- • Responsible disclosure: submit a report
- • DPA requests: contact@vulcai.io
Last updated: 2026-05-29 · Back to dashboard →