PRIVACY, SECURITY & DATA USAGE GOVERNANCE

Standards governing public registry telemetry collection, zero-synthetic-data guarantees, data retention windows, and subscriber confidentiality.

1. PUBLIC REGISTRY DATA SOURCING & ZERO-SYNTHETIC GUARANTEE

AgentRisk DaaS ingests telemetry exclusively from authoritative, public registry endpoints and version control metadata interfaces across the AI software supply chain, including the npm Registry REST API, PyPI JSON API, and GitHub GraphQL API v4.

Zero-Synthetic-Data Commitment: We do not generate, synthesize, or estimate zero-valued metric placeholders to obscure cache misses or unresolvable repositories. If a package exists in a registry but lacks a linked public version control repository, the API returns an explicit, honest HTTP 404 response detailing untrackability.

2. SUBSCRIBER CONFIDENTIALITY & KEY STORAGE

Subscriber API keys are generated cryptographically upon subscription verification and stored strictly in one-way SHA-256 hashed digest format within PostgreSQL. Plaintext API keys are dispatched once via transactional email and cannot be recovered or retrieved by AgentRisk personnel.

We do not sell, license, or expose subscriber query logs or package lookup histories to third parties. Query logs are utilized exclusively for rate-limiting enforcement and internal infrastructure performance tuning.

3. TELEMETRY RETENTION & TIME-SERIES SNAPSHOTS

Historical telemetry snapshots (PackageRiskMetric) are retained in Neon PostgreSQL for a maximum window of 30 days per package to support time-series velocity and anomalous activity calculations.

Stale telemetry records (older than CACHE_TTL_HOURS = 6) trigger background revalidation tasks upon consumer request to ensure fresh risk data without blocking main thread execution.

4. GOVERNANCE ENQUIRIES & DPO CONTACT

For data governance inquiries, vulnerability disclosures, or privacy requests, please contact our engineering team directly:

asteriostech@gmail.com