Privacy Policy

Effective 30 October 2026

This policy explains how Valitura ("we", "us") collects, uses, shares and protects personal information when you use Akesis by Valitura at akesis.app (the "Service"), and the choices you have.

1. Our role

For information about people who visit our website, contact us, or administer an organisation's account with us, Valitura is the controller.

Akesis is used by organisations to manage vulnerabilities in their own software. For the findings, repository, pull request, audit and other information that an organisation and its connected services put into the Service ("Customer Content"), we act as a processor (or "service provider") on the organisation's instructions, under our Data Processing Agreement. If your information appears in an organisation's Akesis account, for example as the author of a pull request, please contact that organisation.

2. Information we collect

Account information: your work email address, your name if your organisation's identity provider sends it, the identity provider's identifier for you, your role and when you last signed in. We don't hold passwords: you sign in through your organisation's identity provider.
Sessions: your browser's user-agent and when the session expires. The session token is stored only as a hash.
Customer Content: vulnerability findings from your scanners and code hosts, repositories, pull requests and CI results, policies, accepted risks, ticket links, AI risk narratives, coverage percentages, and, if your CI sends it, which files and functions use each package. This includes the code-host account names of people who opened pull requests, and the bot accounts your automation uses.
Your source code, for analysis only: to tell whether a vulnerable package is reachable, Akesis reads parts of the code as it streams and keeps only a one-line verdict. It stores none of the code.
Integration data: the tokens and keys you give us for connected services, encrypted; the Jira account email you enter; the addresses of webhook endpoints you add; and the names and scopes of API and assistant tokens, which are stored only as hashes. Alerts your monitoring tools send us may contain whatever those tools include, such as an alert's title and link.
Audit records: security-relevant actions, with the time and the internal identifier of the person who acted, in a tamper-evident log.
Technical information: IP addresses and request data, which our hosting provider logs to deliver and protect the Service, and in short-lived counters that limit sign-in attempts by connected AI apps.
Communications: messages you send us.

3. How we use information

To provide, secure and maintain the Service, including authenticating people and enforcing roles.
To send the notifications you set up, such as Slack alerts and Jira tickets.
To keep audit records, detect abuse and investigate security incidents.
To respond to support and sales requests, and to manage our agreement with your organisation.
To comply with legal obligations and enforce our terms.

We don't sell personal information, share it for cross-context behavioural advertising, or use Customer Content or source code to train AI models.

4. AI

AI is used only to write risk narratives, and only when it's switched on for your organisation. The model sees facts Akesis already holds about a finding, never your source code. Requests run on Amazon Bedrock in your organisation's region (EU organisations in the EU), and prompts aren't logged.

5. Legal bases (EEA, UK and similar regimes)

Where the GDPR or UK GDPR applies to our role as controller, we rely on:

performance of a contract, to provide the Service your organisation signed up for;
our legitimate interests in securing the Service, preventing abuse, keeping audit records and improving reliability;
compliance with legal obligations; and
consent, where we ask for it, which you can withdraw at any time.

6. Cookies and similar technologies

We use only what the Service needs: a session cookie that keeps you signed in, short-lived cookies during sign-in and while connecting GitHub, and browser storage that remembers whether you chose the light or dark theme. We don't use advertising or analytics cookies.

The companies that help us run the Service are listed on our sub-processors page: our database provider, our hosting provider, and Amazon Bedrock when AI features are on.

Services you connect, such as your code hosts, scanners, Jira, Slack, Sentry and AI assistants, receive or send information at your direction, under your own agreements with them. Public vulnerability sources we query receive only public identifiers, such as CVE IDs and package names.

We may also disclose information to comply with law or legal process, to protect rights, safety and security, or in connection with a merger, financing or sale of our business, in which case we will require the recipient to honour this policy.

8. Where information is stored and transfers

Akesis stores data in the United States (AWS us-east-2). If you are elsewhere, your information is transferred to and processed in the United States. For transfers from the EEA, the UK and Switzerland we rely on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, as set out in our Data Processing Agreement. EU data storage is coming soon; contact us if you need it. Until then, the EU setting governs only where AI processing runs.

9. How long we keep information

Account information is kept while the account is active. When someone is removed from an organisation, their account is erased; the audit log keeps only an internal identifier for what they did.
Customer Content is kept while your organisation uses the Service.
Audit records are kept for your organisation's retention setting, from 1 to 10 years (7 by default).
When your organisation leaves, access is cut, integrations are disconnected and you receive a full export. Within 30 days of you confirming the export, we delete your data. The audit log is then anonymised, so who acted and in which repository are erased, and what remains is kept for seven years to show what happened, then deleted. We keep a record that the deletion took place. Copies in our database provider's backups are removed when those backups expire.
Hosting request logs are kept under our hosting provider's log retention.
We may keep information longer where the law requires or to resolve disputes.

10. Your rights and choices

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive it in a portable format, and to withdraw consent. If you are in the EEA or UK you may also lodge a complaint with your local data protection authority.

For information in an organisation's Akesis account, that organisation decides: its admins can find, export and erase what Akesis holds about a person (Admin, Data subject requests). For anything else, write to privacy@akesis.app.

If you are a California resident, you have the right to know what personal information we collect and how it is used and disclosed, to request deletion or correction, and not to be discriminated against for exercising your rights. We don't sell or share personal information as those terms are defined in California law.

We will verify your identity before acting on a request and respond within the time required by law.

11. Security

Each organisation's data is separated by the database itself; credentials you give us are encrypted with keys held outside the database; sign-in goes through your identity provider; and every security-relevant action is recorded in a tamper-evident audit log. Security and your data has the details. No system is completely secure. If a breach affects your information, we will notify affected customers and authorities as the law requires.

12. Children

The Service is for business use and is not directed to anyone under 18. We don't knowingly collect information from children.

13. Changes to this policy

We may update this policy. If changes are material we will tell organisations' admins by email or in the Service before they take effect. The effective date above shows when it was last revised.

14. Contact us

Valitura, 1065 SW 8th, Unit 5579, Miami, FL 33130, USA. privacy@akesis.app