Privacy Policy

Statute OS is operated by TOM projet inc., a company registered in the Province of Quebec, Canada. We provide an AI governance platform that helps organizations assess their AI systems against regulatory frameworks including the EU AI Act, GDPR, NIST AI RMF, and ISO 42001. For the purposes of the EU General Data Protection Regulation (GDPR) and Quebec's Act respecting the protection of personal information in the private sector (Law 25), we are the controller of the personal data described in this policy. You can reach us at privacy@statuteos.com.

Statute OS is built on a zero-copy architecture. When you connect a data platform (Databricks, Snowflake, AWS, GCP, Azure), our scanners read only metadata and audit configuration — table names, permission settings, encryption flags, audit log settings. We never read, copy, ingest, or store the contents of your tables, your training data, your model weights, or your customers' personal data. That data stays in your environment; for connected platforms we see how your data is governed, never what it is.

To be precise about the boundary: this guarantee covers the systems you connect. It is separate from the material you deliberately send us — your questionnaire answers and any evidence documents you upload — which we do process, including through the AI providers named in sections 5 and 6. We draw the distinction explicitly because a privacy commitment that blurs it would not be worth relying on.

We collect the following categories of personal data:

• Account data — your name, work email address, password (hashed by our authentication provider), and organization name and industry, collected when you sign up.
• Billing data — subscription tier and payment status. Card details are processed and stored by Stripe; they never touch our servers.
• Evidence documents — files you choose to upload as compliance evidence (e.g. policies, model cards). These may contain personal data you control; you remain the controller of that content and we process it as your processor.
• Platform connection credentials — API tokens you provide to connect your platforms, encrypted at rest with AES-256-GCM. Used solely to run metadata scans you initiate.
• Usage and audit data — actions taken in the platform (assessment created, report downloaded), recorded in a tamper-evident audit log, plus IP addresses for rate limiting and security.
• Support communications — messages you send us.

• Performance of contract (Art. 6(1)(b) GDPR) — providing the platform: running scans, generating gap analyses, reports, and badges.
• Legitimate interests (Art. 6(1)(f)) — securing the service, preventing abuse (rate limiting), and maintaining the integrity of the audit log.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records related to billing.
• Consent (Art. 6(1)(a)) — optional product communications. We do not send marketing email without consent, and you can withdraw it at any time.

Statute OS uses large language models to analyze content you deliberately submit: the answers you type into our questionnaire, metadata observations our scanners derive from your connected platform configurations, and documents you upload as compliance evidence (such as model cards and policies). OpenAI processes this content for gap analysis and regulatory search embeddings. Anthropic processes gap context for our CLI feature and acts as a fallback for evidence summarization when OpenAI is unavailable.

To be explicit about what these providers do not receive: they never receive the contents of your databases, your customers' data, your model weights, your training data, or any other data from your connected systems. The zero-copy boundary described in section 2 means that data never enters this pipeline at all. What reaches AI providers is limited to what you type and what you upload for assessment — nothing from your infrastructure.

We do not use your submitted content to train our own models. We do not opt you into provider training, feedback, evaluation, or fine-tuning programs. For the commercial/API AI services we use, inputs and outputs are handled under the providers' business terms and are not used to train their general models by default; provider terms, account settings, abuse-prevention retention, and any future configuration changes remain applicable. See the OpenAI business data policy and Azure OpenAI data privacy guidance for the applicable provider commitments.

We do not promise complete anonymity: operating an account requires identifiers such as your name, work email, and organization, and uploaded evidence may identify people or businesses. Instead, we apply data minimization and pseudonymization where practical. Internal LLM audit records store hashes of prompts and outputs rather than the prompt or output content itself, and access is limited to authorized personnel and service providers needed to operate the platform.

Our gap analyses and compliance scores are decision-support outputs reviewed and acted on by you. We do not make automated decisions about you that produce legal or similarly significant effects within the meaning of Art. 22 GDPR.

We never sell personal data. We share data with these providers only as needed to run the service, under data processing agreements. Neither AI provider (Anthropic, OpenAI) receives corporate data, proprietary information, or any data from your connected platforms — only the assessment content you deliberately submit to us. We do not authorize those providers to use that assessment content to train their general-purpose models.

Where personal data is transferred outside the European Economic Area (for example to US-based subprocessors), we rely on the European Commission's Standard Contractual Clauses and, where applicable, adequacy decisions such as the EU–US Data Privacy Framework.

• Account data — kept while your account is active; deleted within 30 days of account deletion.
• Evidence documents and assessments — kept while your organization's workspace exists; deleted on workspace deletion.
• Audit logs — retained for the life of the workspace to preserve tamper-evidence; they record actions, not document contents.
• Billing records — retained as required by tax law (typically 7–10 years).
• Rate-limiting IP data — automatically expires within 1 hour.

Under the GDPR (and similar laws such as Quebec Law 25, PIPEDA, CCPA, and LGPD), you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Have your data erased (Art. 17)
• Restrict or object to processing (Arts. 18, 21)
• Receive your data in a portable format (Art. 20)
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with your supervisory authority

To exercise any of these rights, email privacy@statuteos.com. We respond within 30 days.

We protect your data with encryption in transit (TLS, HSTS) and at rest, AES-256-GCM encryption for platform credentials, row-level security isolating each organization's data, HMAC-chained tamper-evident audit logging, and role-based access controls. No method of transmission or storage is 100% secure, but security is the core of what we sell and we treat it accordingly.

Zero-trust posture. We authenticate and authorize access at each request, isolate organizations with row-level security, encrypt platform credentials at rest, and limit connected-platform scans to approved metadata and configuration. We do not treat network location as proof of trust. These controls reduce risk, but no security architecture can make risk zero.

We use only essential cookies: the authentication session cookie that keeps you signed in and a preference cookie for your active organization. We do not use advertising or cross-site tracking cookies, so there is no cookie banner to click.

Statute OS is a business tool and is not directed at children under 16. We do not knowingly collect personal data from children.

If we make material changes, we will notify account holders by email and update the effective date above. Continued use after the effective date constitutes acceptance.

TOM projet inc., Province of Quebec, Canada. Email: privacy@statuteos.com. If you are in the EU, you may contact your local data protection authority; in Quebec, the Commission d'accès à l'information (CAI).