Legal

Privacy Policy

Effective date: October 5, 2026

CVEasy AI, a product of BlueTeamAutomation LLC ("we," "us," or "our"), is committed to protecting your privacy. This policy explains what information we collect, how we use it, and your rights regarding that information.

1. Information we collect

Email address only. The only personal information we collect is your email address when you sign up for product updates or product updates via the form on our website.

We do not collect:

TRIX threat intel accounts. If you create an account for the threat intel board or the TRIX API, we also keep the organization and use case you give us, per day counts of your lookups and API calls (not their content), and, when you accept the TRIX terms or create, rotate, or revoke a key, the time, the terms version, and the IP address and browser the request came from. That last record cannot be edited after the fact; it is how either side can show later what was agreed. You can delete a TRIX account yourself from the account page; that removes your login, account record, keys and mailing list entry, and keeps only that record. Your password is held by our login provider, Netlify Identity, and never reaches us. If you sign in with Google or GitHub, they share your email address and name with us, and your password stays with them.

Licence checks. When you activate CVEasy AI, and about every six hours while it runs, the app sends us your licence ID, a fingerprint of the device (a hash, not a serial number), the app version and, where the app reports it, the number of assets it holds. We record each check with the time, the IP address it came from and the browser or app identifier, because that record is how we enforce seat limits and investigate a shared licence key. It cannot be edited after the fact.

AI record anchoring. CVEasy AI keeps a signed record of every AI request and agent action on your machine. About every six hours, when there is new activity, a licensed install also sends us the record's latest entry number and a fingerprint of it, plus the public half of the install's record signing key, and receives a signed receipt. That lets you, or your auditor, prove the record was not rewritten later. We receive only those numbers and hashes; no prompt, answer, tool input or result ever leaves your machine this way. An install in offline mode, or without a licence, sends nothing.

Daily workspace usage on the MSSP editions. CVEasy MSSP and CVEasy Red MSSP are billed by the number of client workspaces, so once a day a licensed MSSP install sends us how many workspaces it ran, created and deleted that day and, for each workspace, its size and activity in coarse terms: the number of assets and of findings as a range (for example 51 to 250), a count of uses of each product area from a fixed list (such as dashboard, reports or attack validation), and the date it was last active. Each workspace is identified only by an alias computed on your machine with a key that never leaves it, so we cannot tell which client a workspace belongs to or see its name. No client names, hosts, prompts or answers are sent. The report carries your licence ID and device fingerprint, and the request's IP address is recorded as for licence checks. Other editions, and an MSSP install in offline mode or without a licence, send nothing.

Workspace findings summary on the MSSP editions. Unless data sharing is switched off for the licence, the same daily report also carries, for each workspace, a summary of its open findings: how many there are in total, by severity and by TRIS action band, how many are on CISA's Known Exploited Vulnerabilities list, and up to 25 of its highest-scoring CVEs, each with its public CVE identifier, severity, TRIS score and band, EPSS score, whether it is known exploited, and how many of the workspace's assets it affects (a count, never which ones). We use it to show the MSSP a posture report per workspace. The workspace is identified by the same alias, so we still cannot tell which client it belongs to, and no hostnames, IP addresses, asset names, finding text or other free text are sent: our server accepts only those counts, scores and CVE identifiers and refuses a report carrying anything outside them. Data sharing is on by default for MSSP licences; ask us to switch it off and the install is told to stop sending the summary at its next licence check, and any summary that still arrives is discarded. Switching sharing off stops new summaries but does not erase those already received. We keep each daily summary for 400 days and then delete it automatically, and we delete all of a customer's summaries sooner if the customer is deleted.

2. The product is local-first

CVEasy AI software runs entirely on your own hardware under standard operation. Under normal operation, we have no visibility into your vulnerability data, CVE scan results, remediation notes, or any other data processed by the application. If you choose to configure optional cloud-based AI providers (e.g., third-party AI providers such as OpenAI or similar services), queries to those services are subject to their respective privacy policies. Your operational security data never touches our servers. What the software does send, licence checks, AI record anchoring and, on Core, anonymous usage counts, is described in section 1 and section 3, and contains none of it.

3. Usage data on CVEasy Core

This section applies only to CVEasy Core, the 50-asset plan, which installs an edition without the AI engine. CVEasy Starter, CVEasy, CVEasy Red, CVEasy Enterprise and CVEasy Red Enterprise send no usage data.

Why. Core is priced lower because anonymous usage data helps us improve CVEasy: it tells us which features people rely on, where imports fail or run slowly, and which features Core users want. Sending it is a condition of the Core plan, stated at checkout and shown in the app on first run. Nothing is sent until you acknowledge that first-run screen, which explains what is collected and what never is. After that it is not optional on Core; if you do not want it, the other editions send none. It never blocks or slows the app: if it cannot be sent, CVEasy keeps working normally and tries again later, and anything still unsent after 30 days is discarded on your computer.

What is collected. Once a day, Core sends counts for the previous day (UTC):

Each daily batch carries the licence ID and device fingerprint your copy already sends to check its licence, so we can tie it to a licence for support.

What is never collected. Core never sends, and our server rejects any batch that contains:

How it is stored, pseudonymised and kept. The batches your copy sends are stored with our database provider, Neon, per licence, so we can help you if you contact support, and are deleted 35 days after we receive them. Once a day we turn the previous day's batches into aggregates and send those to our telemetry warehouse, hosted by Cloudflare. Before anything leaves Neon, the licence ID is replaced by a pseudonymous install key (a keyed one-way hash that we cannot reverse without a secret held separately), and no licence ID, email address or device fingerprint is included. Every count except the per-install activity row is only kept for groups of at least 5 installations; smaller groups are merged into a single "other" total. These pseudonymised aggregates are kept for 25 months, then deleted. Usage data is only ever reported in aggregate across all Core installations. We do not sell it, share it, or use it for advertising.

Seeing exactly what is sent. In CVEasy Core, open Settings → Usage data. It shows the batch waiting to be sent, exactly as it will be sent, and the last 30 batches that were sent along with our server's response to each, and it has an Export button. To ask for a copy of the usage data we hold for your licence, or to have it deleted, contact [email protected].

4. How we use your email

We use your email address solely to:

We will never sell, rent, or share your email address with third parties for marketing purposes.

5. Third-party services

Our website uses the following third-party services:

6. Data retention

Email addresses collected through our early-access form are retained until you request removal. We do not retain email addresses longer than necessary for the purpose they were collected. CVEasy Core usage batches are deleted 35 days after we receive them; the pseudonymised daily aggregates made from them are kept for 25 months and then deleted (see section 3). Daily workspace findings summaries from the MSSP editions are kept for 400 days (see section 1). Licence check records and AI record anchors are the permanent audit trail for a licence: our database refuses to edit or delete them, which is what makes them trustworthy evidence for you and for us. If you ask us to erase your data, we will delete what can be deleted and tell you which of these records we keep and why.

7. Your rights

You have the right to:

To exercise these rights, contact us at [email protected].

8. Cookies

This website does not use tracking cookies or analytics scripts. No cookies are set by cveasyai.com beyond what is technically required by Netlify's infrastructure. During checkout, Stripe sets strictly necessary fraud-prevention cookies on its own domain (stripe.com), governed by Stripe's Privacy Policy. We set no advertising or analytics cookies of any kind.

9. Children's privacy

CVEasy AI is a professional security tool intended for adults. We do not knowingly collect information from anyone under the age of 18.

10. Changes to this policy

We may update this policy as the product evolves. Material changes will be noted with an updated date at the top of this page.

11. Contact

Questions about this policy? Reach us at [email protected].

Terms of Service → ← Back to Home