Privacy Policy

Last updated: May 2026

This policy covers both the free TokenID CLI (runs locally on your machine) and the Vaudit hosted platform at app.audit.id.

What we collect

When you use the free CLI, we collect anonymous usage and stability statistics — crash reports, performance metrics, and feature usage — associated with the email address you verified at first start. We do not collect, transmit, or store the content of your LLM calls. Prompts, completions, token counts, and cost estimates all remain in local SQLite on your machine.

When you use the hosted platform, we additionally collect the usage metadata you send us through our SDKs, proxy, or ingest endpoints — token counts, model names, request timestamps, estimated costs, latency, and provider names. We do not collect prompt content or tool outputs.

• Account data — email address, organization name, role assignments.
• Usage data — anonymous product analytics from the free CLI; metadata about LLM calls you send to the hosted platform.
• API connection credentials — encrypted at rest using Fernet (AES-128-CBC + HMAC-SHA256). We do not store plaintext provider API keys.
• Log data — standard server logs (IP address, user agent, timestamps) retained for 30 days.

What we never collect

• Prompt content or LLM completions
• Source code or file contents
• Tool call inputs or outputs

How we use it

We use the data we collect to:

• Provide and operate the products you have signed up for.
• Keep the software stable, diagnose crashes, and ship bug fixes.
• Improve the products through A/B experiments on new releases.
• Identify usage patterns that indicate an enterprise opportunity, and reach out about plans that match that scale.
• Communicate with you about your account, security, and product updates.

We do not sell your data to third parties or use it for advertising.

Opting out of usage telemetry

You can disable usage and crash telemetry from the free CLI at any time with tokenid --no-telemetry. Email verification and license renewal still occur — they are required for your license to remain active.

Opting out also disables the in-app self-upgrade feature and entitlement offers, because both rely on the same usage signal.

Service providers

We rely on a small number of service providers to operate Vaudit. They process data on our behalf under contract:

• Cloud infrastructure (hosted-platform data, EU region).
• Error and performance monitoring (free CLI usage statistics).
• CRM and email (sales and product communication).
• Payment processing (hosted-platform subscriptions).

Data storage

Hosted-platform data is stored on infrastructure within the EU. Credentials are encrypted at rest with Fernet (AES-128-CBC + HMAC-SHA256). Free CLI data stays on your machine.

Retention

Hosted-platform usage records are retained for the duration of your subscription plus 90 days after cancellation, then permanently deleted. Free-CLI usage telemetry is retained for 90 days. You may request immediate deletion by emailing privacy@audit.id.

Your rights

You may request access to, correction of, or deletion of your data at any time. Contact privacy@audit.id. We respond within 30 days.

Cookies

The hosted platform uses a single session cookie for authentication. No advertising or tracking cookies are used.

Contact

Questions about this policy: privacy@audit.id