Privacy Notice

Version 2026-11-01

Rattle processes sign-in email addresses, account identifiers, session and token hashes, repository and target configuration, authorization attestations, run metadata, evidence, reports and billing receipts to provide and secure the service.

Transactional sign-in and report messages are delivered via encrypted email. Stripe hosts payment entry; Rattle stores Checkout identifiers, amounts and paid status, not card details. GitHub user tokens are used transiently to verify installation access and are not persisted.

Managed compute infrastructure provides isolated assessment execution and metering. Source snapshots, target access credentials and assessment evidence are processed only as required to perform authorized work. Do not submit unnecessary personal data or production secrets.

Session cookies are necessary for authentication and request protection. API tokens are stored as hashes and can be revoked. Account-scoped controls restrict access to projects and reports. Backups and billing records may be retained for operational, fraud-prevention or legal obligations.

Contact privacy@rattle.fyi to request access, correction, export or deletion of your data, or to ask about retention and processors. Applicable privacy rights and complaints to your supervisory authority remain available. This notice is version 2026-11-01.