Privacy Policy

This policy explains what RADS Enterprises, LLC ("RADS", "we") collects when you use Kloof, why, and what you can ask us to do about it. Contact: hello@kloof.dev.

What we collect

• Account data — your email address, display name, role, registered passkey public keys and device names, and sign-in timestamps.
• Engagement data — the project name, repository name, GitHub App installation id, ingest token hashes, and the lifecycle stage of your engagement.
• Report data — the findings produced by the battery: check identifiers, statuses, tiers, severities, detail text, reproduction notes, remediation guidance, and reviewer annotations and decisions.
• Audit data — an append-only record of ingests, review decisions, sign-offs, re-openings and deliverable renders, with the actor and timestamp.

We do not run advertising trackers, sell data, or use your findings to train models. We do not ask for production database credentials, and the console does not store staging credentials.

How report data is protected

• Finding detail, reproduction notes and reviewer annotations are encrypted before they are stored.
• Every read is scoped by database row-level security to the project you are a member of. Cross-tenant reads and writes are blocked at the database, not just in the interface.
• Secrets found during a scan are redacted before display; ingest tokens are stored only as hashes.
• Access is invite-only. Kloof reviewers must hold a registered passkey, and irreversible actions require a fresh device confirmation. Sessions sign out automatically after a short period of inactivity.
• Sign-off provenance is immutable: it can be voided, never edited or deleted.

Source code

Scans run on Kloof's runner or your CI, not in the console. Where you grant a read-only GitHub App installation or send a zip, the source is used solely to produce your report and is deleted from the runner when the engagement is delivered. Only the resulting findings are stored in the console.

Processors

We use Supabase for database, authentication and storage; Cloudflare for hosting and delivery; GitHub for the read-only source connection you authorise; and Calendly for scheduling calls. Each processes data on our instructions in order to run the service.

Retention

Reports and their audit trail are kept for the life of your engagement and for 12 months afterwards, so that a delivered artifact stays verifiable. You may ask us to delete a project's reports sooner; the append-only audit record of the deletion itself is retained. Account records are removed within 30 days of a deletion request.

Your choices

Write to hello@kloof.dev to access, correct, export or delete your data, or to remove a registered device. We respond within 30 days. Kloof is operated from the United States; if you are outside it, your data is processed there.

Changes

Material changes are noted by the "last updated" date above and sent to engagement contacts.