Privacy Notice
Privacy Notice
This notice describes what LLM in the Loop Fuzzer collects, why we collect it, how long we keep it, and the
controls you have over it. It applies to the corporate account portal, the Private Scanner Console
(/console), the CI/CD remote API, and the public storefront.
1. Who processes your data
LLM in the Loop Fuzzer (llmloopfuzzer.com) is the data controller for account data, tenant records
and the tamper-evident audit ledger described here. Corporate accounts are provisioned per organisation; we act as
a processor for the scan artifacts you generate in your own estates, on your instruction.
2. What we collect
Account and onboarding data
- Full name, title, corporate organisation, corporate work email, and the scope description you submit with a corporate account request.
- Your licensing tier and tenant identifier, the account status, and the approval decision recorded for your organisation.
- A password hash only. Passwords are stored as PBKDF2-SHA256 (310,000 iterations) with a per-account salt; the plaintext password is never written to disk, logs, or backups.
Service and telemetry data
- Scan artifacts produced by your scans: confirmed findings, redacted request provenance, response evidence, CVSS vectors, and generated remediation proof-of-concept files.
- A SHA-256 hash-chained audit ledger of account and scan lifecycle events (actor, event, timestamp, counters).
- Network metadata used for authentication, rate limiting and abuse prevention: source IP address, user agent,
and authentication outcome. Intermediate proxy addresses are resolved from
CF-Connecting-IPandX-Forwarded-Forheaders. - CI/CD credentials you mint: API key identifiers and SHA-256 hashed key material. Raw keys are shown once and are not recoverable afterwards.
What we do not collect
- No payment card data. Billing runs through Stripe; card numbers are entered on Stripe's hosted checkout and never touch our servers.
- No hosted model and no model credentials on our side. The platform is 100% Bring-Your-Own-Key. The API key you enter per scan is sent to the endpoint you specify and is never persisted by us, logged, or forwarded to a model hosted by us.
- No source code uploads. The scanner observes HTTP traffic and (where you enable it) JavaScript bundles served by your own systems; we do not accept repositories.
3. Where your scan data goes
Prompts never reach us. Hypothesis prompts and context are generated by the scanner and sent directly from the scanning worker to the LLM endpoint you configured (for example Groq, OpenAI, Azure OpenAI, Anthropic, or your own self-hosted vLLM/Ollama endpoint). That provider processes the prompt under its own terms and privacy policy. We act as a data controller for the results, not for the prompt payload at your provider.
If you run a scan without an LLM key, the deterministic verification engine runs locally and no prompt leaves the scanning worker.
4. Retention
| Data | Retention |
|---|---|
| Findings and scan artifacts | Per your tier: 7 days (Free), 12 months (Starter), 24 months (Team), 36 months (Scale and Enterprise). |
| Audit ledger (hash-chained) | Retained for the life of the contract as compliance evidence; exportable on request. |
| Account records | For the life of the account; deleted within 30 days of contract termination, subject to statutory retention duties. |
| Session tokens | Expire automatically; revoking an account invalidates outstanding sessions. |
| Operational backups | Retained for 14 days on a rolling window. Archives are held with owner-only permissions in a restricted directory, and AES-256 encryption at rest is applied when the deployment enables it. Offsite copies are encrypted. |
5. Subprocessors
We rely on a small set of processors. Each is bound by contract and covered by an appropriate transfer mechanism where required:
| Processor | Purpose | Data |
|---|---|---|
| Cloudflare (where the deployment uses its CDN) | CDN, DNS, DDoS protection, TLS termination | IP address, request metadata |
| Stripe | Subscription billing and invoicing | Billing contact and payment method token |
| Your chosen LLM provider | Hypothesis generation (chosen by you, per scan) | Prompt payload and context you sent |
| Your hosting provider | Where the scanning service is deployed | Service data at rest |
6. Security
Data in transit is protected with TLS 1.2+ (including the edge-to-origin hop where a CDN is deployed). Passwords are salted and hashed with PBKDF2-SHA256 at 310,000 iterations, sessions are server-side and expire, administrative and CI/CD credentials are stored as SHA-256 hashes, and every account and scan lifecycle event is written to a SHA-256 hash-chained ledger so tampering is detectable. The service is deployed with a strict Content Security Policy, HSTS, anti-framing and MIME-sniffing protections, per-IP and per-account rate limiting, and an outbound egress guard that blocks loopback, RFC1918, link-local and cloud-metadata destinations (with DNS-rebinding protection).
7. Your rights
Where the GDPR, the Australian Privacy Act, the UK GDPR, or the CCPA applies to you, you may request access to your personal data, correction, deletion, export, restriction of processing, or object to processing. Contact [email protected]; we acknowledge within two business days and respond substantively within 30 days. You may also lodge a complaint with your local supervisory authority. Enterprise customers can execute a Data Processing Addendum (DPA) under the corporate agreement.
8. International transfers
The service may be operated from data centres outside your jurisdiction. Where personal data is transferred internationally, we rely on standard contractual clauses or an applicable adequacy decision, and we document the specific transfer mechanism in your corporate agreement.
9. Children
The service is a professional security-testing platform for organisations and is not directed at children. We do not knowingly collect personal data from anyone under 18. Corporate accounts must be requested by an employee or contractor acting for an organisation.
10. Changes
We update this notice when our processing changes. Material changes are announced in the product changelog and, for Enterprise customers, in the quarterly business review. The effective date at the top of this page identifies the current version.
11. Contact
Privacy questions, access requests and breach notifications: [email protected]. Security disclosures: see the Security & Trust page.