Security

Last updated: May 4, 2026

Our approach

Blacksight is built around one principle: your sensitive data never leaves your control.

• All DLP scanning runs locally on your machines — prompt content is never sent to our servers.
• Only metadata (verdicts, timestamps, destinations) reaches our platform to power dashboards and reports.
• We do not use third-party AI services to process your data.

Infrastructure

• Dedicated infrastructure managed by our team
• All traffic encrypted in transit (TLS 1.2+)
• Data encrypted at rest
• WAF protection against common attack vectors
• Nightly encrypted backups
• Internal services are not publicly exposed

Access control

• Multi-factor authentication
• Role-based access control with organization-level data isolation
• Passwords are salted and hashed using industry-standard algorithms
• Brute-force and credential-stuffing protections

Data we store

Category	Examples	Retention
Account data	Name, email, org name	Until account deletion
Scan metadata	Verdict, destination, detector, timestamp	90 days (configurable)
Audit logs	Login events, policy changes	1 year

Data we never store

• The content of prompts sent to AI tools
• Screenshots, keystrokes, or clipboard contents
• Browsing history unrelated to AI tool usage

Compliance

• GDPR-ready — data minimization by design, right to erasure supported
• CCPA-ready — we do not sell personal information
• SOC 2 Type II — in progress

Data deletion

Request complete data deletion at any time by contacting [email protected]. We process requests within 7 business days.

Incident response

If a security incident affects customer data, we notify affected organizations within 72 hours and provide a full incident report within 14 days.

Responsible disclosure

If you discover a vulnerability, email [email protected]. We acknowledge reports within 2 business days and will not pursue legal action against good-faith researchers.

Contact

For security questions or compliance documentation:

• [email protected]
• +1 (615) 200-7888