Privacy

• Your name, email address, and a hash of your password, and the teams you belong to with your role in each.
• The address each invitation goes to, and what you write in the invitation request form.
• The address at your team’s domain that confirmed the team, with a hash of the code it received.
• Each review agreement’s signer address, stated role, time, scope, and version hash.
• Hashes of API keys and share links, never the keys themselves.
• Your email preferences, and whether your address bounced or complained.
• A session cookie that keeps you signed in.

Riskcovery reviews a site for a team only with verified control and an unrevoked review agreement. Each run starts a fresh Linux machine, where an AI agent reads the site with the tools installed there and writes a report of sections, findings, and metrics. Riskcovery stores that report and deletes the machine when the run ends. The agent is told that everything the site sends is data, never instructions.

Riskcovery also keeps each run’s agent trace: the agent’s model calls and replies, and each tool call with what the tool read from the site. The trace goes to Braintrust, and the parts too long to keep there go to Riskcovery’s bucket in Backblaze B2.

Riskcovery reads a site’s meta tag or verification file through Firecrawl when a team verifies the site with one, and again before each run but a staff evaluation. It asks Firecrawl for a fresh page and asks it not to cache it. Firecrawl’s zero data retention is an Enterprise feature that Riskcovery’s Firecrawl plan does not include, so Firecrawl keeps the proof pages it read under its own retention policy.

Riskcovery staff also run a small number of staff evaluations of public websites that no team has put under review, to measure how the review works on real sites. A staff evaluation is a single run with no verification proof and no review agreement, and it stores what any run does. It is kept under a team only staff belong to, labeled as staff work, mailed to no one, and shown to no customer, and it is deleted 30 days after its day.

• A run loses what Riskcovery keeps for it in Backblaze B2 after 30 days: the long parts of its agent trace and, for an earlier run that crawled the site, its HTML and screenshots, which then show as unavailable. Its report stays while the site exists.
• Deleting a site deletes its runs with their reports, traces, pages, risks, HTML, and screenshots, and its agreements, competitors, and share links, within 7 days.
• Deleting a team deletes its site the same way, its memberships and invitations, and any API key or app authorization tied to that team. If it was your only team, it also deletes your API keys and email preferences. Your account is shared across teams and stays, and while you belong to another team, your other API keys and your email preferences stay for it.
• The Stripe customer and its payment events stay as billing records.
• The machine that ran a review is deleted when the run ends.
• Braintrust keeps a run’s agent trace for 14 days, and deleting the run deletes its trace there too.

Riskcovery has its own project, database, bucket, or key at each vendor.

Vercel

Hosts the website and the api, keeps their request logs, and measures the website's page views and loading speed by path, referrer, country, and device, without query strings or link tokens. Riskcovery copies those logs, page views, and speed measurements, whose paths can name a reviewed host, into its own log store.

PlanetScale

Holds the Riskcovery database: accounts, teams, sites, agreements, runs and their reports, the pages and risks of earlier runs, and billing records, and the public CVE records behind the vulnerability pages.

Backblaze B2

Stores the parts of each run’s agent trace too long to keep in Braintrust, and the HTML and screenshots of earlier runs that crawled the site, each deleted 30 days after its run’s day.

Firecrawl

Reads the meta tag or verification file that proves a team controls a site. It reads no other page for Riskcovery.

boat

Runs each review on a fresh Linux machine, which holds what the agent reads while the run works and is deleted when the run ends.

Inngest

Schedules the daily runs and the email, and keeps their events and step results.

OpenRouter and the model providers it routes to

Receive the agent’s prompts and model calls, which hold the review’s goal and what the agent read from the site, and return the agent’s replies, including its report.

Braintrust

Receives each run’s agent trace: its model calls and replies, and each tool call with what the tool read from the site, to measure their quality, and keeps it for 14 days.

Resend

Sends Riskcovery’s email and receives each recipient’s address and the rendered message.

Dub

Shortens the links in invitation email, so it holds each invitation link.

Stripe

Takes payments in Riskcovery’s own Stripe account: the team, the checkout, the card, and the invoices. Riskcovery never sees a full card number.

Upstash

Counts api requests per key to apply rate limits.

Sentry

Receives error reports in Riskcovery’s own Sentry projects, without page content, evidence, or risks.

PostHog

Receives each page view and each operation you run, such as a review, a report read, or a sign-in, keyed by your account and team ids. It also receives recordings of how you move through the site with all text and inputs masked and images hidden, where you click and scroll, the errors your browser hits, with email addresses and keys removed, and your ratings in its short surveys. For each AI model call in a review, it receives the model, the token counts, the cost, and the time taken, but never the text sent to the model or returned by it. It receives no page content, evidence, risks, email addresses, or keys.

Write to us to see, correct, or delete what Riskcovery holds about you. To delete your account, first delete every team you own in Settings, then write to us.