> ## Documentation Index
> Fetch the complete documentation index at: https:// zenveil.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Data Privacy

> What data ZenVeil collects, how it's stored, and how long it's retained.

## Core principle: scan locally, share minimally

ZenVeil is designed so that the most sensitive operation — scanning your source code — happens entirely on your machine. Your code never touches our servers during a local scan.

## What we collect

### When you use the CLI locally

| Data | Collected? | Where |
| - | - | - |
| Your source code | No | Stays on your machine |
| Finding details (local scan) | No | Stored in `.zenveil-last-scan.json` locally |
| CLI commands | No | No telemetry |
| Errors/crashes | No | No crash reporting by default |

### When you use the dashboard or API

| Data | Collected? | Stored where | Retention |
| - | - | - | - |
| Email address | Yes | MongoDB Atlas | Until account deletion |
| Billing information | Via Stripe | Stripe (not our DB) | Per Stripe policy |
| Scan results (API/dashboard) | Yes | MongoDB Atlas | 30 days (Free), 90 days (Pro) |
| API key hashes | Yes | MongoDB Atlas | Until revoked |
| Stripe webhook events | Yes | MongoDB Atlas | 30 days |

### When you use AI features

When you call `explain`, `fix`, or `triage`:

| Data | Sent to | Retained by ZenVeil |
| - | - | - |
| Finding title & description | Anthropic/Google | No |
| Redacted evidence | Anthropic/Google | No |
| File path & line number | Anthropic/Google | No |
| Your source code | Not sent | N/A |
| Real secret values | Not sent (redacted first) | N/A |

Anthropic's and Google's data retention policies apply to these requests. See:

* [Anthropic's Privacy Policy](https://www.anthropic.com/privacy)
* [Google's Privacy Policy](https://policies.google.com/privacy)

## Data storage

All ZenVeil data is stored in:

* **MongoDB Atlas** — hosted in AWS US-East-1, encrypted at rest and in transit (TLS 1.2+)
* **Stripe** — for billing data. ZenVeil stores only `customerId` and `subscriptionId`, not card details

## Data deletion

**Deleting your account** removes:

* Your user record
* All API keys
* All scan history stored on our servers
* Your subscription (effective at period end)

To request account deletion: email `privacy@zenveil.dev`.

**Deleting local data:**

```bash theme={null}
# Remove scan cache
rm -f .zenveil-last-scan.json .zenveil-ignore.json .zenveil-feedback.json

# Remove credentials
rm -rf ~/.zenveil
```

## GDPR / CCPA compliance

ZenVeil complies with GDPR and CCPA:

* **Right to access**: request a copy of your data at `privacy@zenveil.dev`
* **Right to deletion**: request deletion at `privacy@zenveil.dev`
* **Right to portability**: your scan history can be exported as JSON from the dashboard
* **Data minimization**: we collect only what's necessary to operate the service

## Third-party services

| Service | Purpose | Link |
| - | - | - |
| Stripe | Billing & subscriptions | [stripe.com/privacy](https://stripe.com/privacy) |
| Clerk | Authentication | [clerk.com/privacy](https://clerk.com/privacy) |
| Anthropic | AI analysis | [anthropic.com/privacy](https://www.anthropic.com/privacy) |
| Google | AI fallback (Gemini) | [policies.google.com/privacy](https://policies.google.com/privacy) |
| Render | Hosting | [render.com/privacy](https://render.com/privacy) |
| MongoDB Atlas | Database | [mongodb.com/privacy](https://www.mongodb.com/legal/privacy) |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.