Privacy Policy

1. Introduction

SoterAI ("we," "us," or "our") provides AI security software including prompt injection detection, data-loss prevention, content moderation, red-team analysis, and workflow integration tools. This Privacy Policy describes how we collect, use, store, and protect information when you use the SoterAI platform, APIs, dashboard, marketplace integrations, and related services (collectively, the "Service").

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree, please discontinue use of the Service.

2. Information We Collect

We collect the following categories of information:

• Account information: Email address, display name, organization name, and authentication credentials provided during registration.
• API usage data: Request counts, endpoint usage, response times, error rates, and rate-limit metrics associated with your API keys.
• Integration data: Configuration metadata for connected workflow platforms (n8n, Zapier, Make, Dify, Botpress), including webhook URLs and node configuration settings.
• Dashboard activity: Pages visited, features used, dashboard preferences, and security policy configurations.
• Support communications: Emails, tickets, and messages sent to our support or security teams.

3. AI Workflow Data

SoterAI processes text content (prompts, AI outputs) server-side for security analysis. Raw text is processed in-memory and is not persisted to long-term storage.

Threat detection summaries (risk scores, categories, timestamps, actions taken) are stored for audit and dashboard display. These summaries are derived from the analysis but do not contain the original raw text.

Where content redaction is applied, only redacted versions, hashes, truncated previews, or structured findings are retained. The original unredacted content is discarded after processing.

4. Logs and Audit Records

SoterAI maintains audit logs for security events, policy enforcement actions, and administrative changes. These logs include:

• Timestamps and event identifiers
• Risk scores, threat categories, and actions taken (block, flag, allow)
• API key identifiers (not the full key value)
• IP addresses and user-agent strings for security monitoring
• Policy configuration changes and the user who made them

Audit logs are retained according to the data retention schedule described in Section 8. Logs do not contain the raw text content of scanned prompts or AI outputs.

5. API Keys and Authentication

API keys are stored in encrypted form and cannot be retrieved after creation. You are shown the full key value only once at the time of generation. If a key is lost, it must be revoked and a new key created.

Raw API keys, SCIM tokens, SAML secrets, integration tokens, and detected secrets from content scanning are not stored in plaintext. Authentication credentials are protected using industry-standard hashing and encryption methods.

6. How We Use Information

We use the information we collect for the following purposes:

• Providing, operating, and maintaining the Service
• Performing security analysis on submitted content
• Generating threat detection summaries and risk assessments
• Populating dashboards, audit logs, and reporting features
• Enforcing rate limits and usage quotas
• Authenticating users and authorizing API requests
• Responding to support requests and security inquiries
• Improving detection accuracy, performance, and reliability
• Sending service-related communications (outage alerts, security advisories, billing notices)

We do not sell personal information to third parties. We do not use customer content to train machine learning models without explicit opt-in consent.

7. How We Protect Data

We implement technical and organizational measures to protect the information we process, including:

• Encryption of data in transit (TLS 1.2+) and at rest
• API key hashing and encrypted storage
• Role-based access controls for internal systems
• CSRF protection, rate limiting, and input validation on all endpoints
• Regular security reviews of application code and infrastructure
• In-memory processing of raw content to minimize data persistence

While we take reasonable measures to protect your data, no system is completely secure. We encourage responsible disclosure of any security vulnerabilities to security@soterai.dev.

8. Data Retention

We retain data according to the following guidelines:

• Raw content: Not persisted. Processed in-memory and discarded after analysis completes.
• Threat summaries and audit logs: Retained for the duration specified by your plan and organization settings, typically 30 to 90 days.
• Account information: Retained while your account is active and for a reasonable period afterward for legal and operational purposes.
• API usage metrics: Aggregated usage data may be retained indefinitely in anonymized form for capacity planning.

You may request deletion of your account and associated data by contacting support@soterai.dev.

9. Third-Party Integrations

SoterAI provides integration nodes and connectors for workflow automation platforms including n8n, Zapier, Make, Dify, and Botpress.

Platform integration nodes (n8n, Zapier, Make, Dify, Botpress) are stateless connectors that do not store user data locally. These connectors transmit data to SoterAI's API for processing and return results to the calling platform. Data handling on third-party platforms is governed by those platforms' respective privacy policies.

We recommend reviewing the privacy policies of any third-party platforms you connect to SoterAI to understand how they handle data that passes through their systems.

10. Cookies and Analytics

The SoterAI dashboard may use the following types of cookies and similar technologies:

• Essential cookies: Required for authentication, session management, and CSRF protection. These cannot be disabled.
• Preference cookies: Store dashboard preferences, theme settings, and UI state.
• Analytics: We may use privacy-respecting analytics tools to understand aggregate usage patterns. We do not use advertising trackers or share analytics data with ad networks.

The SoterAI API does not set cookies. API interactions are authenticated solely via API keys transmitted in request headers.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your account and associated personal information.
• Data portability: Request an export of your data in a structured, machine-readable format.
• Objection: Object to certain processing of your personal information.
• Withdrawal of consent: Where processing is based on consent, withdraw consent at any time.

To exercise any of these rights, please contact us at support@soterai.dev. We will respond to requests within 30 days.

12. Children's Privacy

SoterAI is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child under 18, please contact us at support@soterai.dev and we will promptly delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. If we make material changes, we will notify you by posting the updated policy on our website and updating the "Last Updated" date below. For significant changes, we may also notify you via email or through an in-dashboard notification.

Your continued use of the Service after the effective date of a revised Privacy Policy constitutes acceptance of the updated terms.

14. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• General support: support@soterai.dev
• Security concerns: security@soterai.dev

15. Last Updated

This Privacy Policy was last updated on June 2026.