Privacy Policy
Effective Date: September 1, 2026 • Last updated: September 20, 2026
We do not sell your data. We do not use your source code, stack traces, or AST patches to train public machine learning models. All telemetry is customer-isolated, encrypted at rest via AES-256, and processed in ephemeral, zero-persistence sandboxes.
1.Information We Collect
When you interact with SOMAK AI ("the Platform", "we", "our"), we collect only the telemetry and configuration data necessary to provide autonomous incident triage and remediation:
- Account Information: Name, professional email address, organization slug, encrypted credentials, and SSO tokens provided through Google or GitHub OAuth.
- Incident Telemetry: Error fingerprints, stack traces, exception types, environment labels (e.g. staging, production), and HTTP response status codes ingested via Sentry webhooks, Datadog, or OpenTelemetry endpoints.
- Code Snippets & AST Fragments: Only the specific source code lines referenced in crash call stacks, fetched via scoped repository integrations (GitHub App / GitLab Deploy Key) for AST patching.
- Usage & Device Metrics: Anonymized interaction logs, browser user-agent, session timestamps, and system performance metrics used to improve platform stability.
2.How We Use Your Information
We process collected data strictly for the following operational purposes:
- Autonomous log signature clustering and deduping using NVIDIA Nemotron reasoning models.
- Synthesizing zero-regression AST code fixes within ephemeral sandbox containers.
- Executing canary rollouts and monitoring SLO error budget burn rates.
- Delivering automated post-mortem incident reports to your configured Slack or PagerDuty channels.
- Enforcing team role-based access control (RBAC) and audit log tracking.
3. Strict AI Non-Training Commitment
SOMAK AI upholds strict enterprise isolation agreements with our LLM inference providers (NVIDIA NIM, DeepSeek, Anthropic, OpenAI). Under these binding enterprise agreements:
Prompts sent to inference endpoints are processed strictly in RAM and discarded immediately upon completion.
Your proprietary algorithms, stack traces, and patches are never used to train or refine base models.
4.Data Protection & Cryptography
All customer data is handled in alignment with Tamper-Evident Audit controls. We employ defense-in-depth safeguards across all layers:
- Data in Transit: Enforced TLS 1.3 encryption across all public API routes, webhook listeners, and WebSocket streaming channels.
- Data at Rest: AES-256 GCM envelope encryption for all database records, telemetry stores, and organization configuration tokens.
- Ephemeral Sandboxing: Code verification runs inside isolated container sandboxes (Nebius / OCI) with no persistent disks and outbound network egress restricted to authorized registries.
- Secret Sanitization: Automatic redaction of API keys, bearer tokens, passwords, and private certificates before telemetry touches reasoning pipelines.
5.Third-Party Sub-Processors & Data Handling
SOMAK AI engages select enterprise sub-processors to deliver core platform functionalities. All partners are bound by strict Data Processing Agreements (DPAs):
Processes billing and subscriptions as Merchant of Record. Handles global sales tax/VAT compliance. Card details never touch SOMAK AI servers.
Executes ephemeral code test suites and model inference with RAM-only processing and zero telemetry persistence.
Queries official public diagnostic documentation for error resolution patterns without transmitting proprietary customer code.
Provides incoming application exception webhooks verified via HMAC-SHA256 signatures.
6.Cookies & Local Storage
We use strictly necessary browser storage mechanisms to maintain session authentication, your active organization selection, and visual theme preferences (light/dark mode). We do not load invasive third-party cross-site advertising trackers.
7.Data Subject Rights (GDPR & CCPA)
Regardless of your geographic location, SOMAK AI extends comprehensive privacy rights to all registered users:
- Right to access and export your incident history and remediation audit logs.
- Right to request immediate and irreversible deletion of your personal and organization data.
- Right to restrict or revoke repository and telemetry access permissions at any time.
To exercise these rights, workspace owners can dispatch a request to privacy@somak.ai or execute immediate self-service data purging in Organization Settings.
7.Contact Information
For legal inquiries, Data Protection Officer requests, or security vulnerability disclosures, contact our team at: