On a phone, each section opens with a one-line summary. The summaries are not part of this policy and change nothing in it; the full text under each one is what applies.
01The short version
Your source code is sent to AI providers to be analysed. That is how the service works, and it is the single most important thing to understand before you submit anything confidential.
Your source code is not kept. It is deleted as soon as the analysis finishes, with an automatic 24-hour backstop.
We do not use your code to train models, and we do not sell or share your data for advertising. There are no analytics or advertising cookies on this site.
Transactions you send to the Agent Transaction Check are not kept, and never go to an AI provider. We read the transaction and intent to produce a verdict, then discard them. All we keep is a short usage record for billing.
02What we collect
Your account details, sessions, an optional GitHub token, payment records, what you submit, and basic server logs.
Account and identity
- Your email address and display name, if you register with one.
- A password hash, if you set a password. We never store the password.
- If you sign in with Google or GitHub: the provider's identifier for you and the email address it gives us. We do not receive your password.
- If you sign in with a wallet: the wallet address, and the fact that it was proven by signature.
- Account creation and last sign-in timestamps.
Sessions
When you sign in we store only a hash of your session token, never the cookie value itself, together with its creation, expiry and sign-out times.
GitHub connection, if you set one up
Your GitHub username and numeric ID, the scope you granted, and the access token — which is encrypted at rest. This is optional and exists only so the service can fetch repositories you point it at.
Payments
Your paying wallet address, the on-chain transaction reference, amounts, and the ledger of credits and debits against your account balance.
What you submit
The contract source code you upload or point us at, and the findings report produced from it. See section 3.
API keys
If you create an API key, we store only a hash of it, never the key itself, plus its name, its last few characters (so you can tell your keys apart), its spending limit, and when it was created, last used and revoked.
Transactions you send to the Agent Transaction Check
The chain, the sending address, the proposed transaction or message to be signed, your stated intent (token, amount and recipient address), and any policy you set, such as an allowlist of recipient addresses. See section 4.
Technical logs
Ordinary server logs — request paths, timestamps, status codes, IP address and user agent — used to operate and debug the service, and kept for 30 days. We also count visits from them in aggregate (how many pages are viewed, and how many of those views come from people rather than automated traffic), with no cookies and no third-party analytics; the counts identify no one. Output from the analysis tools themselves is kept separately for 7 days.
Please do not submit personal data, credentials, private keys or secrets inside your source code. The service is built to analyse contract logic and treats everything you submit as code, not as personal data needing special handling.
03What happens to your code
Analysed in a no-network sandbox, sent to Anthropic and AWS Bedrock for the AI review, and deleted when the run ends.
When you submit a contract for analysis:
- It is stored briefly in a private object store operated by our hosting provider, readable only by this service.
- It is analysed by the deterministic tool suite, each tool running in an isolated sandbox with no network access, a read-only filesystem and dropped privileges. A tool container cannot send your code anywhere. For a DAML package the deterministic step is a compile check, and where an authorization finding is checked against a ledger, a disposable Canton ledger is started inside that same no-egress sandbox and destroyed with the run — your package is never submitted to any ledger outside it, and never to a real or shared one.
- It is sent to AI providers — Anthropic, and AWS Bedrock — so the hunter, jury and judge agents can interpret what the tools found. This transmission is unavoidable: it is the audit you are paying for. It is more central still for a DAML review: no third-party analyzer is run on a DAML package, so the agents are not interpreting tool output but reading your source directly.
- The uploaded copy is deleted as soon as the run finishes. An automatic lifecycle rule deletes anything left behind within 24 hours, so an interrupted run cannot leave your code sitting there.
We do not use your code to train models, and we do not permit anyone else to do so on our behalf. We access these providers through their commercial APIs, and each provider's own terms govern what it does with the content it receives.
The findings report is kept slightly longer than the code, so that you can re-download it without paying again — see section 9. If you start a remediation engagement, the findings and their status are kept for the life of that engagement.
04What happens to a transaction you check
Read, checked against a node provider’s copy of the chain, and discarded. No AI, and nothing kept but a usage record.
When you send a transaction or a message to be signed to the Agent Transaction Check:
- No AI provider receives it. Every check is a fixed, rule-based comparison run on our own servers.
- To simulate a transaction, we send it to a blockchain node provider, together with the sending address, so the provider can run it against the current state of the chain. The provider sees the transaction before it is signed or broadcast, which is earlier than anyone else would. A message to be signed is decoded on our servers and not sent to the provider.
- The transaction, the message, your intent and your policy are not stored. They are held in memory only while the verdict is produced, then discarded. They are not written to our database or to our server logs.
- We keep a usage record of each check: which account and API key made it, when, on which chain, the verdict, which checks failed, and how long it took. We use it to charge you, apply rate limits, prevent abuse, and answer questions about a verdict. It does not contain the transaction, the message, your intent or any address you sent.
Wallet addresses can identify a person when linked with other information. That is why we keep none of the addresses you send. Once a transaction is broadcast, it and its addresses are public on the chain anyway (see section 7).
05Why we process it
To run your account, the analysis you asked for and your payments; the GitHub token only with your consent.
| What | Why | Basis |
|---|---|---|
| Account and session data | To let you sign in and reach your balance and your work | Performance of our contract with you |
| Submitted code and reports | To produce the analysis you asked for | Performance of our contract with you |
| Payment and ledger records | To take payment, prevent double-spending, and keep financial records | Contract, and legal obligation |
| GitHub token | To fetch the repositories you point us at | Your consent, withdrawable at any time |
| Server logs | To operate, secure and debug the service, and to count visits in aggregate | Our legitimate interest in a service that works and in knowing how it is used |
| Transactions, messages, intents and policies sent to the Agent Transaction Check | To produce the verdict you asked for | Performance of our contract with you |
| Check usage records | To charge you, apply rate limits, prevent abuse and answer questions about a verdict | Contract, and our legitimate interest in a service that is not abused |
07On-chain payments
Payments are public and permanent on the blockchain; deleting your account cannot erase them.
Blockchain transactions are public and permanent. When you pay in USDC, your wallet address, the amount and the timestamp are recorded on a public ledger that anyone can read and that nobody — including us — can edit or erase.
This is inherent to how public blockchains work. A request to delete your account cannot and does not remove anything from the chain. It removes what we hold.
09How long we keep things
Your code is deleted when the run ends; AI providers may hold it for up to 30 days; payment records are kept six years.
| Data | Kept for |
|---|---|
| Submitted source code | Deleted at the end of the run; 24-hour automatic backstop |
| Submitted source code — copy held by our AI providers | Up to 30 days, under those providers’ own standard API terms, then deleted by them. This row is about a retention period we do not set and cannot shorten; the row above is our own copy, which we delete as described |
| Findings report | About one hour after a successful round, so you can re-download it |
| Remediation engagement — findings and their status | Until you delete your account, so your audit history stays complete |
| Remediation engagement — the stored report itself | 30 days from its last round, then cleared. The record of what was found and fixed remains; the full report content does not |
| Account and identity records | Until you delete your account |
| Session records | 30 days, then expired |
| Payment and balance ledger | Six years — kept as a financial record after account deletion |
| Server logs | 30 days |
| Analysis tool output | 7 days |
| Transactions, messages, intents and policies sent to the Agent Transaction Check | Not kept: discarded as soon as the verdict is returned |
| Agent Transaction Check usage records | 90 days, matching the period our liability for checks is measured over (Terms, section 13) |
| Charges for checks | In the payment and balance ledger, six years, like every other charge |
10Security
Encrypted traffic, secrets in a managed store, hashed sessions, isolated tools. Report issues to security@grisoco.com.
- All traffic to the service is encrypted in transit.
- Credentials and signing keys are held in a managed secret store, not in configuration files or the application image.
- Your GitHub access token is encrypted at rest with a key held in that secret store.
- Session tokens are stored only as hashes, so a database disclosure does not hand anyone a usable session.
- Analysis tools run with no network access, a read-only filesystem and dropped privileges.
No system is perfectly secure. If you believe you have found a vulnerability in the service, please report it to security@grisoco.com rather than disclosing it publicly, and we will work with you on it.
11Your rights
You can access, correct, delete or export your data, or complain — write to contact@grisoco.com.
Depending on where you live, you have some or all of the following rights over the data we hold about you:
- Access — a copy of what we hold.
- Correction — to fix anything inaccurate.
- Deletion — to have your account and its data removed, subject to records we must keep by law and to what is already on-chain.
- Portability — to receive your data in a machine-readable form.
- Objection and restriction — to object to processing based on legitimate interests.
- Withdrawing consent — for example by disconnecting GitHub, at any time, without affecting processing already carried out.
- Nomination — to nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
- Complaint — to the Data Protection Board of India, or to your local data protection authority if you are outside India.
To exercise any of these, contact us at contact@grisoco.com. We aim to respond within 30 days. We may need to verify who you are first — for an account secured by a wallet, that means a signature from it.
Grievances
If you are unhappy with how we have handled your data or your request, write to contact@grisoco.com with "Grievance" in the subject line. Your complaint goes to the person responsible for answering questions about how this service processes personal data. If you are still unsatisfied, you may escalate to the Data Protection Board of India.
12International transfers
Hosted in the United States; Indian law governs.
The service and your data are hosted in the United States, and this service is governed by Indian law. Submitted code and account identifiers are processed there to deliver the service, under the safeguards in our providers' agreements.
13Children
Not for anyone under 18.
The service is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
14Changes
We may update this policy, with notice before material changes.
We may update this policy. The "last updated" date above always reflects the current version, and for material changes — particularly any change to who processes your code — we will give notice before they take effect.
15Contact
See also our Terms of Service.