Privacy Policy

1. Data Controller

Sixi AI, Switzerland (“we”, “us”), operates this platform and acts as the data controller for personal data processed through it. Processing is carried out in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Swiss Federal Act on Data Protection (FADP). For any data-related questions, contact contact@sixi.ai.

2. Data We Collect

• Account data: Email address, display name, authentication credentials (managed by Firebase Authentication), and the country you declare at registration.
• Scan configuration: Target endpoint URLs, connector types, and scan parameters you configure.
• Scan results: Attack payloads sent to your target, target responses, evidence of vulnerabilities, and generated reports.
• Audit trail: Timestamps, user actions, IP addresses, and request metadata for security and accountability.

3. How Your Data Is Used

• To execute security assessments against targets you authorize.
• To generate vulnerability reports and remediation recommendations.
• To improve attack technique effectiveness across scans (anonymized cross-scan learning).
• To maintain audit trails for compliance and accountability.

4. Legal Basis (GDPR Article 6)

• Contract performance (Art. 6(1)(b)): Processing scan data is necessary to provide the service you requested.
• Legitimate interest (Art. 6(1)(f)): Cross-scan learning to improve technique effectiveness, with your data anonymized.
• Legal obligation (Art. 6(1)(c)): Maintaining audit logs as required by applicable law.

5. Data Retention

The platform applies the principle of storage limitation (GDPR Article 5(1)(e)):

• Scan evidence (payloads, responses, attack chains): automatically deleted after 90 days.
• Scan metadata (name, status, risk rating): archived after 365 days (evidence subcollections deleted, metadata retained).
• Audit logs: retained for 2 years, then automatically deleted.
• You can delete individual scans and targets at any time through the dashboard.

6. Data Security

• All data in transit is protected by TLS 1.3.
• Data at rest is encrypted by Google Cloud (AES-256).
• Sensitive fields (credentials, evidence, conversation histories, attack payloads) are additionally encrypted at the application level using AES-128-CBC + HMAC-SHA256 (Fernet).
• Authentication secrets in target configurations are masked in UI responses and encrypted in storage.

7. Your Rights (GDPR Chapter III)

Under the GDPR, you have the right to:

• Access your personal data (Art. 15) — download scan reports via the dashboard.
• Rectification (Art. 16) — update your account information.
• Erasure (Art. 17) — delete your scans, targets, and account.
• Data portability (Art. 20) — export scan reports in JSON, PDF, or Markdown format.
• Object to processing (Art. 21) — contact us to opt out of cross-scan learning.

8. Cross-Scan Learning

Successful attack techniques are stored in an anonymized library to improve effectiveness across future scans. When shared cross-user, target names and response content are stripped. You can request exclusion by emailing contact@sixi.ai.

9. Sub-Processors

• Google Cloud (Firestore): Data storage and authentication. EU data residency on request.
• LLM provider: Google (Gemini) generates and evaluates attack payloads for the hosted service. Only the target's responses and assessment context are sent — never your account data. A deployed package uses the provider its operator configures.

10. Contact

For privacy inquiries, data subject requests, or to report concerns:
Email: contact@sixi.ai