FaultFence Privacy Notice

Last updated: October 29, 2026 · Effective: October 27, 2026

1. Who operates FaultFence?

FaultFence is an experimental service for testing the security of AI agents with financial authority, using authorized, synthetic, nonproduction scenarios. This notice covers the FaultFence website, hosted account/dashboard and Testing Kit, not the independent privacy practices of an AI model provider you choose to use.

Service operator: Ishan Pravin Parab

Location: Mumbai, Maharashtra, India

Postal correspondence: For a mailing address concerning privacy inquiries, contact ishan@faultfence.com.

Contact: ishan@faultfence.com

Privacy and grievance contact: Ishan Pravin Parab is the named contact for privacy requests, concerns and complaints at ishan@faultfence.com.

Initial beta audience: FaultFence primarily targets developers and security testers in the United States, Canada, and India. The website currently provides open self-service signup without a country-based access restriction, so people in other places may also access it. Applicable privacy rights depend on the circumstances and law, not just the countries named here.

2. Information processed

• Accounts: email, account identifier, verification status, session and authentication information, and sign-in activity handled by the authentication provider.
• Terms acceptance: accepted Beta Terms version, acceptance record and timestamp.
• Assessments you explicitly save: configuration, prompts, tool arguments, simulated financial transaction information, event traces, findings and other report content uploaded with the saved assessment.
• Technical records: IP address, device/browser details, session identifiers, cookies, and operational or security logs that may be processed by infrastructure providers.
• Communications: information you provide in support, privacy or security inquiries.
• Site analytics: the operator confirms Vercel Web Analytics is disabled in the Vercel project, and the beta frontend no longer imports its analytics package. Ordinary hosting and security logs may still be processed.

Do not submit live payment credentials, API keys, real personal financial records or confidential production material.

3. Local testing and cloud saving

The Python Testing Kit runs on your own computer using your Docker environment. In the currently tested workflow, local assessment generation and preview do not automatically upload a report to the FaultFence dashboard. If you explicitly choose to save an assessment to your account, its full saved contents are uploaded to the hosted database. Review reports before saving; they may contain synthetic prompts, tool calls and detailed traces. Additional telemetry or upload behavior in a future release must be separately reviewed and disclosed.

The public Get Started guide and officially published Testing Kit can be accessed without creating a FaultFence account. Visiting the page or downloading the archive may still generate ordinary website and download-host request logs, including technical information such as IP address and browser details. Downloading the kit does not itself create a FaultFence account, and running local tests does not by itself upload your reports to FaultFence.

4. Optional external model providers

Separately authorized model-enabled assessments may send synthetic prompts, tool content and related context to your selected AI model provider. The provider's privacy notice and terms also apply, and provider charges may arise. Customer-owned provider API keys should be configured locally as directed, not placed in dashboard fields or reports. In the reviewed Testing Kit, the controlled model gateway runs locally; it sends authorized synthetic test content to the selected provider. Provider-side logging and retention are governed by that provider's practices; FaultFence does not control a third-party model provider's retention settings.

OpenAI API (when selected): OpenAI publishes a default abuse-monitoring log retention period of up to 30 days, with exceptions for legal, safety or security needs and different settings for eligible API accounts. The logs can include submitted content. API data is not used for model training by default unless the API customer opts in. See OpenAI API data controls. Other model providers have their own policies.

5. Purposes and legal bases

Information may be used to create and protect accounts, verify email, record terms acceptance, operate the dashboard, save assessments at your request, respond to inquiries, investigate abuse or incidents, and keep the service functioning.

FaultFence processes account and session information to provide and secure the service, records acceptance of applicable Beta Terms, and processes report content when you explicitly choose cloud saving. Optional provider data egress requires a separate opt-in. Legal rights and the lawful basis for processing vary by applicable jurisdiction; contact the privacy address above to ask about your information or exercise rights available to you.

6. Service providers and data transfers

• Supabase: account authentication and hosted assessment database. The operator reports project region us-east-1 (United States); this does not describe every provider processing location.
• Website hosting: Vercel, confirmed by the operator. Its infrastructure and subprocessors may process technical information in more than one location.
• Public Testing Kit download: the official download currently links to a GitHub release asset. GitHub and its delivery providers may process download requests and technical logs under their own policies. This does not mean FaultFence automatically receives local test reports.
• Web Analytics: the operator confirms optional Vercel Web Analytics is disabled in the project, and the local frontend has removed the analytics integration. Hosting and security logs are separate.
• Legacy request form: the reviewed /assessment route redirects to self-service signup instead of submitting to Web3Forms. Any earlier submissions held by that provider require separate retention/deletion review.
• Your selected AI model provider: only for separately authorized model-enabled testing, as described above.

Service providers may process information in countries other than yours. Specific provider processing locations, subprocessors, safeguards and legal requirements depend on those providers and the user's jurisdiction. Contact us if you need information relevant to your use of FaultFence.

For users in Canada, India, and other locations outside the United States, choosing to create an account or cloud-save an assessment can involve transferring and storing that information in the United States through the Supabase project region listed above. Hosting and authentication logs may be processed in other provider locations, and separately authorized AI-model requests may involve further provider transfers. The beta does not offer a selectable account-data residency region.

7. Cookies and analytics

Essential session technology may be used to maintain sign-in and protect authenticated access. Hosting and authentication providers may generate service and security logs. The operator confirms optional Vercel Web Analytics is disabled. Session cookies and ordinary provider logs are distinct from optional analytics. Their retention periods are governed by the relevant service/provider settings and policies.

Browser Do Not Track and cross-site activity: FaultFence does not currently implement a site-specific response to browser Do Not Track signals. The reviewed frontend does not enable Vercel Web Analytics or intentional advertising-based cross-site tracking. Infrastructure and authentication providers may separately collect technical information across services they operate; their own privacy notices govern that activity. We do not have verified information to describe every provider's tracking practice as disabled.

8. Retention and deletion

For this beta, account and acceptance records are maintained while the account is active, subject to applicable legal obligations. Cloud-saved assessments remain until the user deletes them or an authorized account-deletion process removes them. Provider log retention and applicable legal retention exceptions may vary.

Users can delete saved reports and consolidated assessments from the dashboard. In a disposable-account test, the operator deleted the account through Supabase Auth; a subsequent database check returned zero rows for that user in Auth, individual reports, consolidated assessments, and Beta Terms acceptance records. This verifies those active database rows, not immediate erasure of every provider-held log or copy.

The Supabase Free project does not include scheduled project backups, and no restore procedure has been demonstrated. Data loss may therefore be unrecoverable; keep local copies of reports. Deletion of active assessment records does not promise immediate deletion from every infrastructure log or provider-held copy.

Published provider log access periods: Vercel states that runtime logs are viewable for 1 hour on its Hobby plan, with different periods on other plans; see Vercel runtime log documentation. Supabase states that Free-plan users can access the last day of logs; see Supabase log access documentation. Those are user-visible access windows, not guarantees of permanent deletion from provider internal systems. OpenAI API default abuse-monitoring retention is described in Section 4. Other provider security, operational, authentication, backup or legally preserved records may be handled differently. We have not verified a universal deletion period covering every provider record; contact the privacy email for questions or requests.

9. Your choices and requests

You can keep assessment previews local rather than choosing cloud save, and you can decline separately authorized model-enabled testing. Depending on applicable law, you may be able to request access, correction, export or deletion of your personal information, object to some processing, withdraw consent where it applies, or complain to a regulator. Verification may be required to protect your account.

Account deletion/request process: Email ishan@faultfence.com from your account email address. FaultFence will verify the request before deleting the authentication account and its associated active database records. We will respond within applicable legal deadlines.

Privacy questions and complaints can be sent to the service operator at the contact address above. We will review the request and explain the available next steps. Where applicable, you may also contact a competent privacy regulator.

10. Security

FaultFence uses technical account and database access controls intended to restrict saved assessment records to authorized owners. No online service can guarantee perfect security. Avoid uploading secrets or real financial data.

11. Changes

FaultFence may revise this notice as data practices change. For material changes, FaultFence will provide any additional notice or consent required by applicable law.

12. Contact

Privacy: ishan@faultfence.com

Support: ishan@faultfence.com

Security reports: ishan@faultfence.com

Questions about this notice can be sent to the contact address above.