Privacy policy

Draft pending legal review. Sections marked [TO VALIDATE] need confirmation before publication.

Who we are

Hykaro is a security-audit service operated by Cyril Pereira ("we", "us"). Hykaro lets vendors connect a Git repository or a URL, run security/quality/accessibility scans, and deliver a white-label PDF report to their own clients.

• Data controller: Cyril Pereira. [TO VALIDATE: legal entity, SIRET, registered address]
• Contact: privacy@hykaro.security
• Hosting / data location: Scaleway, France (EU). We do not move scan data outside the EU except for the AI triage sub-processor described below.

What data we collect

Account data. Email, name, hashed password, organization name, role, and authentication metadata (sessions, MFA enrolment, audit log).

Billing data. Plan, invoices, and payment status. Card details are handled directly by Stripe; we never see or store full card numbers.

Target data. The Git repository or URL you connect, and the source code or HTTP responses fetched only for the duration of a scan. In CI-agent mode, your source code never leaves your infrastructure; we only ingest the resulting findings.

Scan results. Findings (rule, severity, file/line, short code snippet), scores, and the generated reports.

Usage data. Product analytics via PostHog (EU instance), strictly to improve the service.

How we use it

• Deliver the service: run scans, store findings, generate reports.
• Bill you and prevent abuse (quotas, fraud).
• Send transactional notifications you configured (scan completion, failures).
• Improve the product (aggregated analytics).

Legal bases (GDPR): performance of our contract with you; our legitimate interest in securing and improving the service; and your consent for non-essential analytics.

Scan isolation & security

• Each scan runs in an ephemeral Docker container launched with --network=none. No internet access, no access to other scans, no access to the orchestrator. The temporary filesystem is destroyed immediately after findings are extracted.
• Encryption: TLS 1.3 in transit, AES-256 at rest (PostgreSQL and object storage, Scaleway-managed).
• Authentication: opaque Redis sessions, JWT for the API, optional TOTP MFA, role-based access control (4 roles), and an immutable audit log.

AI triage (opt-in)

When AI triage is enabled (Standard tier and above), only consolidated findings are sent to Anthropic (Claude) for prioritization: CWE identifier, file:line, and a snippet of at most 5 lines. No secrets, no full source code, no client data. AI triage is opt-out at any time at no extra cost. [TO VALIDATE: Anthropic data-processing terms / zero-retention confirmation]

Sub-processors

Sub-processor	Purpose	Location
Scaleway	Hosting, database, object storage	France (EU)
Stripe	Payments	EU / US
Anthropic (Claude)	AI triage (opt-in only)	US
PostHog	Product analytics	EU
Mailjet / OVH	Transactional email	France (EU)

A full, current list and our Data Processing Agreement (DPA) are available on request: privacy@hykaro.security.

Data retention

• Account & billing data: kept while your account is active and as required by law (accounting obligations). [TO VALIDATE: exact accounting retention, e.g. 10 years for invoices in France]
• Scan artifacts (findings, reports): retained per plan tier: 30 / 90 / 180 / 365 days. [TO VALIDATE: final durations]
• Source code / scan working copies: destroyed immediately after each scan.

Your rights

Under the GDPR you may request: access, rectification, erasure, portability, restriction, and objection. To exercise any right, email privacy@hykaro.security. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Cookies

We use essential cookies (session, security) and analytics cookies (PostHog, EU). See our cookie notice for details and to manage your choices. [TO VALIDATE: consent banner & cookie inventory]

Changes

We may update this policy. The "last updated" date at the top reflects the current version; material changes will be communicated to account holders.