This policy explains what data naxxan.ai and NAXXAN verification services collect, where it goes, and when it is deleted. Questions: engagements@naxxan.ai.
Engagement data — the signed scope, target references, findings, and raw proof-of-concept evidence produced during a paid engagement. This is security-sensitive by definition: it is stored on infrastructure we control, is never used to train models, and is deleted per the retention schedule below.
Operational telemetry of our own agent — command and gate logs produced by our verification tooling while it runs. These logs exist to make every action auditable; they are retained with the engagement they belong to.
Site access — our site is served through a CDN; standard access logs may include IP address and requested URL, kept for the provider's default operational window.
Engagement scanning and evidence handling run on our own infrastructure. During an engagement, a language-model API is used for hypothesis drafting; surface data, findings, and response excerpts are transmitted over TLS to and processed by our model provider under its API terms. The current provider publishes that API content is not stored and is not used to improve its services without explicit agreement; we verify the terms per provider and model before any change and disclose the provider per engagement, before processing your data. We do not control provider-side compliance. The verbatim "where does my data go" answer for your specific engagement is stated in the engagement's data-handling sheet before work begins.
We use AI assistance in our pipeline for drafting hypotheses and remediation text. Deterministic verifiers — not model judgment — decide every reported finding. No engagement data is used to train any model, ours or a provider's.
Your report and technical evidence are deleted 90 days after the retest completes — or, if no retest is requested, 90 days after the request window expires or the engagement closes, whichever comes first. The signed contract package is kept seven years for legal and financial proof. Early deletion on request is honored except for records we must keep under legal, contractual or tax obligations, or evidence under a documented dispute hold.
We do not sell data. We do not publish client names or findings without written permission — our public pages show only fully redacted, permissioned material. We do not run scans against anyone without a signed scope.
You may ask what engagement data associated with you we hold and request correction of inaccurate personal data (contact below). Security-research reports about our site are handled per our security reporting page.
We may update this policy; the version at this URL is the current one. Material changes affecting engagement data are also stated in new data-handling sheets.
Effective date: 2026-09-16 · Contact: engagements@naxxan.ai