CYBO Attest
Privacy Policy
This policy explains what personal information Ulap Inc ("Ulap", "we" or "us") collects when your organization uses CYBO Attest (the "Service"), why, who helps us process it, and how long we keep it.
1. What we collect
- Account details: your name, work email, and organization name.
- Billing: payments are handled by Stripe. We receive the status of your subscription and payments, not your full card number.
- Repository contents: when you connect a repository with its address and a read only token, the Service makes a private copy of it in GitLab operated by Ulap to scan it. Repositories can contain personal information, such as commit author names and email addresses.
- Scan and review records: results, justifications, and decisions, including the name of the person who made each decision.
- Sign in: sign in to the Service is handled through Keycloak, which keeps your account identity and session.
- Email: we send service email, such as account and billing messages, through Amazon SES.
- AI agents you connect: you can connect an AI client, such as Claude, to the Service through its MCP server at attest.ulapcybo.app/mcp. You sign in on our sign in page; the client receives a short lived token tied to your account and can read and change only what your account can. We record each change it makes with your name and the client's name, for example "mike via claude". What the client reads goes into your conversation with it and is handled by that client's provider under its own terms, not by us. Repository tokens are never passed to an AI client.
- Explainable AI: when you ask the Service to explain a finding, a gate, or a build, the relevant scan records are sent to CERA, the model service Ulap operates, called as you, and the answer is returned to you. CERA answers with models Ulap hosts or with models on Amazon Bedrock. CERA does not keep the prompts or the answers, and keeps no logs of them. CERA runs in AWS GovCloud (US West).
- Technical logs: the Service keeps request logs to run and secure it, and deletes them after 48 hours.
2. Why we use it
- To provide the Service: create and manage your account, scan your repositories, and keep your records.
- To bill for your subscription.
- To send you service email and answer your requests.
- To keep the Service secure and prevent misuse.
- To meet legal obligations.
We do not sell personal information. We never use repository contents or other Customer Content to train AI models. We do not send marketing email to registered users. If that changes, every marketing message will let you opt out.
3. Subprocessors
These providers process personal information for us to run the Service:
- Stripe: payments and billing.
- Amazon Web Services: hosting, Explainable AI models through Amazon Bedrock, and service email through Amazon SES.
- GitLab: hosting for the private copies of connected repositories and for scan evidence.
- Neon: database hosting.
We may also disclose information where the law requires it, or as part of a merger or sale of our business. Account and scan records are kept in a PostgreSQL database hosted by Neon in the United States, in AWS US East (Ohio).
4. How long we keep it
- Account details, private repository copies, and scan records: kept until you ask us to delete them. When a subscription ends, your organization keeps its account and can still sign in and read its records; it cannot start new scans.
- When you ask us to delete your data, by writing to contact@ulap.co, we delete it within 30 days, except where the law requires us to keep it.
- Billing records: as long as tax and accounting law requires. Stripe keeps payment data under its own policy.
- Backups: Neon keeps restore history of the database under its own backup policy. Data we delete leaves that history when it ages out.
5. Security
We use reasonable administrative, technical, and organizational measures designed to protect personal information. No method of storage or transmission is completely secure.
6. Your choices and rights
Depending on where you live, you may have the right to:
- Know and access: ask what personal information we hold about you and get a copy of it.
- Correct: ask us to fix information that is wrong.
- Delete: ask us to delete your personal information.
- Portability: get your information in a common, machine readable format.
- Object or restrict: ask us to stop or limit some uses of your information.
- Opt out: of the sale of personal information, or its use for targeted advertising. We do not sell personal information.
- Withdraw consent: where we rely on your consent, withdraw it at any time.
To use any of these rights, write to contact@ulap.co. We will confirm your request, may ask for information to verify who you are, and answer within 30 days, or sooner where the law requires. You may name an authorized agent to ask for you. We will not treat you differently for using your rights.
Your organization's data. When your organization uses the Service, it decides what goes into it, and we process that content on its behalf. Your organization's administrator can manage users, and we may refer requests about your organization's content to it.
United States. Residents of California and other states with consumer privacy laws have the rights above as those laws provide. If we decline a request, you may appeal by replying to our answer, and we will tell you the result of the appeal.
European Economic Area, United Kingdom, and Switzerland. We use personal information to provide the Service under our contract with your organization, for our legitimate interests in running and securing the Service, to meet legal obligations, and with your consent where it is required. Your information is stored and processed in the United States; where the law requires it, we protect transfers with standard contractual clauses. You may complain to your local data protection authority.
7. This website and the web application
ulapcybo.app and the CYBO Attest web application measure visits with Plausible Analytics, which counts page views without cookies and without collecting personal information. ulapcybo.app sends the contact and briefing forms through Formspree and uses the LinkedIn Insight Tag.
8. Children
The Service is for businesses and is not directed to children.
9. Changes
We may update this policy. We will post the new version here with a new effective date, and tell account holders about material changes.
10. Contact
Ulap Inc, 136 Norman Court, Inlet Beach, FL 32461. Email contact@ulap.co.