Privacy Policy

Last updated: 26 September 2026

Download as Word (.docx)

1. What we collect

• Submitted artifacts: the code you ask us to verify, its SHA-256 hash, the verdict, and the engine transcript. We cannot verify without it.
• Account data: email address, API keys, credit balance, and purchase records from our merchant of record.
• Metering records: compute time, credits charged, timestamps — kept in a tamper-evident log so your bill always reconciles.
• Operational logs: IP addresses and request metadata for abuse prevention, kept briefly.

2. What we never do

We never sell your data. We never use your submitted code to train models. We never disclose your artifacts except as needed to operate the service (e.g., payment processing by our merchant of record) or as required by law.

3. Why certificates are public-ish

A certificate is useful precisely because third parties can check it. Certificate contents (artifact hash, verdict, toolchain, serial, validity) and the revocation list are queryable by anyone. The artifact source itself is not published — only its hash.

4. Retention and deletion

• Artifacts and transcripts: retained while your account is active, to support re-verification and dispute handling; deleted within 90 days of account closure on request.
• Metering and purchase records: retained as required for tax and accounting (typically 7 years), in anonymized form where possible after closure.
• Operational logs: 30 days.

To request deletion or a copy of your data: hello@axiom-code.com. Some records (revoked certificate entries, tax records) cannot be deleted while the law requires them.

5. Security

CA signing keys are held separately from the web service with restricted access; see Security. No method is perfect; we disclose breaches affecting your data promptly.