Privacy Policy

This policy explains how Auterim handles information when you visit auterim.com, use the free tools, or create and use an Auterim workspace. It applies to account holders, the people they invite to a workspace, and visitors to the site.

In this policy, “Auterim”, “we” and “us” mean the operator of auterim.com and the Auterim service, who is responsible for the information described here.

Auterim is a business service. It is built to monitor software, APIs and infrastructure, not to profile individuals.

You give us information when you create an account, set up a workspace, confirm the dependencies you rely on, or contact us. We only ask for what the service needs to work.

• Your email address and a password. Passwords are handled by our authentication provider and are never stored by Auterim in readable form.
• Your role within a workspace, such as owner, admin or member.
• If you turn on two-step login, the authenticator factor is kept by our authentication provider. Auterim does not keep the secret behind your codes.

• Your company website address and workspace name.
• Optional context you add to help Auterim judge relevance, such as how critical a dependency is, which features or endpoints you use, and short notes about your setup.

The list of external services your business relies on, whether discovered by Auterim or added by you, along with the changes Auterim finds for them, deadlines, and the actions taken on each.

When you ask Auterim to scan a website, it reads the pages a browser would load from that site, such as markup, scripts, headers and linked hosts, to suggest services the site appears to use. It does not log in, submit forms or access anything behind authentication.

A scan from the free scanner on our site is not saved against your identity. Scans you run inside a workspace are saved to that workspace so you can confirm the results.

You can choose to connect GitHub, Slack, Linear or Sentry. Each connection asks only for the access its feature needs, and you can revoke it at any time.

• GitHub. Read-only access to the contents of the repositories you select. Auterim reads a bounded set of files to check whether a change affects your code or configuration. It does not keep copies of your source code. It stores the finding itself, such as the file path, line, commit and a short explanation, with secret-shaped content redacted.
• Slack. Permission to list channels and post the alerts you route there.
• Linear. Permission to read your workspace structure and create issues for changes you choose to hand off.
• Sentry. Read access to summaries of unresolved issues in a limited number of projects, used as a relevance signal.
• Auterim CLI. Runs on your own computer. discover reads project manifests locally and uploads nothing. connect uploads, only after you confirm in the terminal, derived metadata: provider names, kinds of evidence, safe relative paths, the project folder name and a sanitized Git remote. It never uploads source files, environment values or credentials. login stores a read-only credential for one Product in your user configuration folder; owners and admins can revoke it at any time in Settings.

Access credentials for connected services are encrypted before they are stored.

We keep the operational records needed to run the service, such as monitoring runs, scan results, delivery status of alerts, and an audit trail of connector events.

On the public site we count a small set of first-party events, such as a page view or a started signup, together with the page and any campaign tags in the link. These events are not tied to a cookie or an advertising identifier. We do not use third-party analytics or advertising trackers.

Paid plans are billed through our payment provider. Auterim shares your email address and workspace reference with it to create your subscription. Card details are entered with the payment provider and are not received or stored by Auterim. We keep the plan, status and billing period of your subscription.

• To discover and monitor the services you depend on and detect changes to them.
• To decide whether a change is material and whether it is relevant to your workspace.
• To verify impact in connected repositories when you have enabled it, and to prepare remediation guidance for review.
• To send the alerts and handoffs you have configured.
• To run, secure and support the service, and to bill for it.

Auterim uses language model providers to classify changes and to assess their impact on a workspace. Requests contain the change evidence and a bounded, redacted summary of the relevant workspace context. They are sent with storage disabled at the provider, and they are not used by Auterim to train models. When you have not said how you use a dependency, Auterim assumes the usage typical for that kind of provider and marks the result as unconfirmed. Results are recommendations for people to review.

Every request to your workspace is authorized on the server, and database access is restricted per workspace. See the Security page for how Auterim protects operational data.

We use a small number of providers to host and run Auterim. They process information only on our instructions and only to provide their service to us. We do not sell personal information.

• Vercel hosts the website and application.
• Supabase provides the database and account sign-in, hosted in the European Union.
• Trigger.dev runs scheduled monitoring and background work.
• Microsoft Azure AI classifies changes, assesses their impact and drafts fixes, as described in Automated analysis.
• OpenRouter routes a second, independent check of public provider changes. It receives only the public change evidence, never workspace information.
• Amazon Web Services runs the isolated runner that tests prepared fixes against a bounded snapshot of your repository code.
• Resend delivers account and alert emails.
• Dodo Payments processes subscriptions and payments as our merchant of record.

Services you choose to connect, such as GitHub, Slack, Linear, Sentry or Vercel, receive and send only what that connection needs.

The Subprocessors page lists what each provider processes and where. Customers can rely on our Data Processing Addendum.

Where data protection law such as the GDPR applies, we process information to perform our contract with you (providing the service and billing for it), for our legitimate interests in securing and improving Auterim, to meet legal obligations such as tax records, and with your consent where we ask for it, for example when you connect a service.

We keep account and workspace information while your workspace has an active trial or paid plan.

When a workspace has no active plan, because the trial ended without a subscription or a subscription was cancelled, it becomes read-only. After 90 days without an active plan, we delete its workspace data, including dependencies, context, connections and change history. Choosing a plan within those 90 days restores the workspace as it was.

Evidence about your Production deployments, such as which deployment was live and whether a change affected its code, is kept for at most 12 months and then deleted. It is deleted sooner when its workspace is deleted or when you ask us to.

We keep billing records for as long as tax and accounting law requires, and short-lived operational logs for security. You can delete your account yourself in Settings, under Profile: workspaces you are the only member of are deleted with it, and you leave shared workspaces. You can also ask us to delete your account and workspace data by writing to support@auterim.com.

Depending on where you live, you may have the right to access, correct, export or delete your personal information, or to object to or restrict how it is used. To make a request, write to support@auterim.com from the email address on your account. You can also disconnect any connected service from your workspace at any time. If you are in the EEA or the UK, you can also complain to your local data protection authority.

Workspace data is stored in the European Union. Some of our service providers process information in other countries, such as the United States. Where that happens, transfers are covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell account owners before it takes effect.

For privacy questions or requests, write to support@auterim.com.