Legal

Privacy Policy

How Privent handles your data and protects your privacy.

Last updated31 March 2026

Overview

Privent is developed by SHIFTBASE LABS LTD (71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom). This policy applies to the Privent agent security platform: the n8n integration, detection backend, semantic analysis service, document engine, the browser extension, and related admin surfaces. For customer workflow and employee prompt analysis, customers act as Controller and Privent acts as Processor.

What Data We Process

–Workflow and prompt submission data: agent payload or prompt text, tool identifier, source URL path, timestamp, and request identifier, processed in memory for scoring.

–Detection metadata: decision (allow/warn/block), risk score, category, processing status, reason code, and event timestamps.

–Vault data: sensitive values replaced by tokens are held encrypted so that authorized detokenization can restore them at trusted sinks.

–Document job data: job status, file metadata, and processing artifacts for tokenize and detokenize jobs, downloadable by authorized users.

–File-intercept data: in extension debug mode, file metadata and sampled file payload data may be processed for detection.

–Activation and auth data: activation token hash in extension storage, browser identifier, organization API key usage metadata, activation token use metadata (including IP address and user agent on backend activation records).

What We Don't Store

–Raw prompt and agent payload text is never persisted; it is processed in memory only.

–Tool call outputs and retrieved document contents are not stored in detection tables.

–The extension does not persist raw prompt text, raw file contents, or raw activation tokens to browser storage (only a token hash is stored).

Accuracy note: The backend persists detection event metadata and never raw prompt text. When the LLM judge confirms a block and a vector store is configured, an embedding vector derived from the content (never the text itself) is stored with category and risk level. Self-hosted deployments that don't configure a vector store persist nothing beyond event metadata.

How Data Is Processed

01.Privent nodes inside your n8n workflow send payloads to the detection backend over HTTPS at execution time; the browser extension captures submit-time prompt events on supported GenAI domains and sends sanitized payloads the same way.

02.The backend combines regex/rule signals and semantic-engine outputs to calculate risk and produce allow/warn/block decisions.

03.The semantic engine processes request text in memory for NER and embedding-based scoring, then returns analysis output to the backend.

04.APE transformation replaces sensitive values with reversible tokens held in the encrypted vault; detokenization is restricted to trusted sinks.

Security Measures

–HTTPS-only endpoint validation in extension transport layers.

–Manifest V3 architecture with extension page CSP and module service worker.

–Sender-origin allowlist and strict runtime message shape validation.

–Payload sanitization, tool allowlists, URL normalization, and size limits.

–Diagnostic logging is disabled by default outside explicit debug mode.

Privent is pursuing SOC 2 Type II certification. Our current security posture, controls, and policies are available at trust.privent.ai. For the full picture, including key management and the data-handling columns, read the security overview.

Data Retention

–Detection metadata (including risk outcomes and source URL fields) is stored in backend event tables for audit and reporting.

–Activation token usage records, API key usage metadata, and activation state are stored in backend systems.

–Automated retention/deletion schedules are not found in current backend code. Operational retention controls may be managed outside application code.

Third-party Services

The semantic engine in this codebase uses local model inference components (spaCy and SentenceTransformers). Direct runtime calls from semantic-engine code to third-party LLM APIs were not found in code. This statement does not cover infrastructure-level providers used to host services.

User Control and Transparency

–Activation tokens are removed from activation page URLs after ingestion.

–Managed enterprise configuration can override local extension auth settings.

–Requests for access, correction, or deletion should be sent to hello@privent.ai.

Contact

For privacy-related enquiries, contact hello@privent.ai.