Security & trust

What we see, what we don't, and why

This page states our data-handling claims precisely enough to be checked against the actual source, not just taken on faith. Every "what we never see" item below is enforced today, and every compliance claim is stated exactly as far as it currently goes — no further.

Architecture & data flow

  1. 1. Your machine Claude Code / Cowork hooks call the local engine on every tool call.
  2. 2. Local engine Deterministic rules evaluate the call. Shadow mode logs; enforce mode can block.
  3. 3. Local storage Findings and settings live in ~/.pinkyai. Nothing here is uploaded automatically.
  4. 4. Cloud (optional) Only reached for account, entitlement, rule-pack updates, and opt-in telemetry.

Step 4 is reached only for account sign-in, entitlement checks, rule-pack update fetches, and — only if you opt in — telemetry counters. It is never in the path of evaluating a single tool call.

What we never see

  • The content of your files, commands, or Claude Code / Cowork conversations
  • Your API keys, secrets, or credentials — catching these before they leak is the product's job, not a place they end up
  • Anything at all from a session, unless you explicitly opt in to telemetry — and even then, only bounded aggregate counts, never content

What the cloud side ever holds

  • Account identity — email and name, from your identity provider
  • Organization membership and role (owner/admin/member)
  • Entitlement — plan and seat count, so enforcement can be authorized
  • An audit trail of administrative actions (role changes, entitlement changes) — never scan findings or session content
  • Rule-pack version metadata, so your install knows what's current

Telemetry, in detail

Telemetry is off by default and stays off until you turn it on. Once on, it reports a small, fixed set of aggregate counters (rule fire counts, tokens-saved buckets) — never the content that triggered them. The full schema of exactly what's counted is public: app.pinkyai.io/telemetry.

Compliance roadmap

SOC 2 aligned, Type I planned. We've mapped our own controls against SOC 2's Trust Services Criteria and use that mapping to guide the engineering work itself — but no formal audit has happened yet, and we won't claim certification until an independent auditor has actually issued a report. A lightweight security questionnaire pack is available on request once you're evaluating us for procurement.