Privacy Policy

Last updated: May 1, 2026

1. Scope and Applicability

This Privacy Policy applies to all CloudSlash products, services, and websites operated by CloudSlash Contributors ("we", "us", "our"). This includes:

• CloudSlash CLI — the open-source command-line tool and daemon
• CloudSlash Cloud — the managed web service at app.cloudslash.dev
• CloudSlash Registry — the plugin and policy registry at registry.cloudslash.dev
• CloudSlash Websites — cloudslash.dev and docs.cloudslash.dev

Each product handles data differently. We describe each below in detail.

2. CloudSlash CLI and Self-Hosted Deployments

CloudSlash CLI collects zero data.

When you install and run CloudSlash locally, no telemetry, analytics, crash reports, usage metrics, or infrastructure data is sent to any external server. All operations — including scans, graph construction, policy evaluation, and remediation — execute entirely on your machine or within your network.

• No phone-home behavior of any kind
• No anonymous usage statistics
• No crash reporting to external services
• No automatic update checks (updates are opt-in via cloudslash upgrade)

Your cloud provider credentials, infrastructure metadata, scan results, policy configurations, and AI prompts remain entirely under your control. We have no mechanism to access, view, or retrieve any data from self-hosted installations.

AI Backends

When using the DEVI AI engine locally with Ollama, all inference runs on your hardware. If you configure an external AI provider (OpenAI, Anthropic), data is sent directly from your machine to that provider under their privacy terms. CloudSlash does not proxy, log, or retain any AI-related data.

3. CloudSlash Cloud (app.cloudslash.dev)

CloudSlash Cloud is the optional managed service. When you use it, we process the following data:

Account Data

• Email address (for authentication and notifications)
• Organization name and team memberships
• OAuth tokens for GitHub/GitLab integration (encrypted at rest)

Infrastructure Data

• Cloud provider credentials (encrypted at rest with AES-256-GCM, stored in isolated vaults per tenant)
• Scan results, dependency graphs, and remediation logs
• Policy configurations and approval workflows

Infrastructure data is processed solely to provide the service. We do not sell, share, license, or use your infrastructure data for any purpose other than operating CloudSlash Cloud for your account.

Data Isolation

Each tenant's data is logically isolated. Credentials are encrypted per-tenant with unique keys. Database queries are scoped to the authenticated organization. We do not aggregate data across tenants.

4. Website (cloudslash.dev)

The CloudSlash website does not use cookies, tracking pixels, analytics services, or advertising scripts. We do not collect any personal data through the website.

• No Google Analytics, Mixpanel, Segment, or similar services
• No cookie consent banners (because there are no cookies)
• No third-party marketing or retargeting tags

The website makes a single API call to api.github.com to display live repository statistics. This request is made from your browser directly to GitHub and is subject to GitHub's privacy policy.

5. Registry (registry.cloudslash.dev)

When you publish or install packages from the CloudSlash Registry, we collect:

• Publisher account information (email, display name, organization)
• Package metadata (name, version, description, license)
• Download counts (aggregated, not per-user)

We do not track which users install which packages. Download counts are incremented anonymously.

6. AI and Machine Learning

We do not use your data to train AI models.

CloudSlash does not use any customer infrastructure data, scan results, policies, or other user-generated content to train, fine-tune, or improve machine learning models. This applies to both self-hosted and cloud deployments.

7. Third-Party Services

CloudSlash Cloud uses the following infrastructure providers:

• Hosting — application servers and databases are hosted on infrastructure we control
• Email — transactional emails (password resets, notifications) are sent via a third-party email provider
• Authentication — OAuth via GitHub/GitLab is used for login (subject to their respective privacy policies)

We do not use any third-party data brokers, analytics platforms, or advertising networks.

8. Data Retention

• CloudSlash CLI: No data is collected, therefore no retention applies
• CloudSlash Cloud: Data is retained for the duration of your account. Upon account deletion, all data including credentials, scan history, and configurations is permanently deleted within 30 days
• Registry: Published packages remain available until the publisher removes them. Account data is deleted upon request

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Object to or restrict processing
• Withdraw consent at any time

To exercise any of these rights, contact us at privacy@cloudslash.dev.

10. Security

We implement the following security measures for CloudSlash Cloud:

• AES-256-GCM encryption at rest for all sensitive data
• TLS 1.3 for all data in transit
• Per-tenant credential isolation with unique encryption keys
• Role-based access control with audit logging
• Regular security reviews and dependency audits

If you discover a security vulnerability, please report it to security@cloudslash.dev. We follow responsible disclosure practices.

11. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. Material changes will be communicated via the CloudSlash website and, for CloudSlash Cloud users, via email notification at least 30 days before they take effect.

12. Contact

For questions about this Privacy Policy or our data practices:

• Email: privacy@cloudslash.dev
• GitHub: github.com/DrSkyle/CloudSlash/discussions