Privacy Policy

We are responsible for personal information used to respond to website inquiries, administer customer relationships and accounts, and conduct our own business operations. You can contact us for privacy questions or requests at secure@nullbrick.ai or at the mailing address below.

When a customer organization provides scan findings or uploads an SBOM for processing on its behalf, the organization generally determines the purpose of that processing. Our responsibilities are governed by the customer agreement and any applicable data processing agreement. If a request concerns information controlled by your employer or another customer, contact that organization first; we will assist as required by the applicable agreement and law.

Contact and demo inquiries. Our website form collects your name, work email address, company, phone number, and message. Inquiry submissions and related correspondence are received or stored through Google Workspace.

Accounts and business records. Nullbrick creates application accounts after a customer agreement is signed. We handle account identifiers, business contact information, sign-in records, support correspondence, and information needed to administer the customer relationship. Customers pay by invoice and bank transfer; we handle billing contacts, invoice records, and payment status for that purpose.

Scan findings and SBOMs. The customer information we primarily receive is scan findings. Customers can also upload software bills of materials (SBOMs) containing software package and infrastructure details. These records can incidentally include personal information if present in the submitted findings or metadata. Do not include unrelated personal information or secrets in uploads.

Nullbrick does not receive or store customer source code or complete container images, including temporarily for scanning. We do not store customer integration credentials, such as registry passwords or repository tokens. This does not describe the separate handling of application account authentication.

Security records. We collect and review security logs relating to sign-in activity, administrative activity, and suspicious activity to protect the service. We also use public vulnerability information to provide CVE explanations and recommendations.

We use information to respond to inquiries; create and administer accounts; provide scan visibility, SBOM analysis, image catalog and lineage information, and remediation recommendations; support customers; protect the service; manage invoices and customer agreements; and fulfill legal obligations.

We send replies to inquiries and necessary service messages, including account, security, and material policy updates. We do not send promotional newsletters or promotional email campaigns. We do not use customer data to train or fine-tune AI models.

We do not use website analytics tools or advertising trackers. You can manage cookies and similar browser storage through your browser settings; blocking technologies required by a sign-in workflow may affect that workflow. Contact secure@nullbrick.ai with questions about browser storage associated with your use of Nullbrick.

Nullbrick uses AWS Bedrock for AI-assisted analysis of public CVE information. We send only public CVE details to Bedrock, rather than customer scan findings, uploaded SBOMs, source code, or other customer data. Bedrock requests are confined to AWS regions in Northern Virginia and Ohio.

AI-generated explanations and recommendations can be incomplete or inaccurate. Nullbrick provides recommendations; customers review the evidence and decide whether and how to make changes.

We use Amazon Web Services (AWS) to host and operate the application and Google Workspace to handle inquiry and business communications. AWS Bedrock processes public CVE details as described above. The information handled by each service depends on its role.

Information may be available to authorized users and administrators in your organization according to assigned roles. Nullbrick support access to customer data is limited to authorized staff, requires customer approval, is time-limited, and is logged. A controlled emergency exception permits narrowly scoped access for an urgent security incident, with logging and customer notification under the customer agreement.

We may disclose information when directed by you, when required by law or lawful process, to protect rights and service security, or in connection with a merger, acquisition, or sale of the relevant business, subject to applicable protections.

We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

When Nullbrick stores customer scan findings, uploaded SBOMs, and related application data, the databases, stored scan files, and backups are kept in AWS Northern Virginia and Ohio. Nullbrick staff do not access customer data from outside the United States.

The AWS location statement describes the application environment. It does not establish the processing or storage locations of Google Workspace communications. Information submitted from another country may be processed in the United States. Contact secure@nullbrick.ai for questions about processing locations and applicable contractual arrangements.

Customer data is encrypted in transit and at rest, including in databases, storage, and backups. We use role-based access restrictions and the support-access controls described above. No method of transmission or storage guarantees complete security. Additional service information is available at https://nullbrick.ai/security.

Scan findings and uploaded SBOMs are retained for 30 days, subject to the applicable customer agreement. Customers can download available scan findings and SBOMs while their subscription is active. There is no additional export-access period after the subscription ends; customers should arrange downloads before that date.

Inquiry correspondence, account information, billing records, support records, security logs, and backups are separate data categories. The 30-day scan-data period does not establish a deletion deadline for these categories or for residual backup copies. Contact secure@nullbrick.ai for information about retention or to request deletion. Requests are subject to applicable law and customer agreement obligations.

Depending on your location and applicable law, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to processing; withdraw consent where processing relies on consent; or exercise other applicable privacy rights. Exceptions may apply. Withdrawal of consent does not affect earlier lawful processing.

Send requests to secure@nullbrick.ai with enough information to identify the relevant relationship and request. We may need to verify your identity or an authorized representative’s authority. Do not send passwords or unrelated sensitive information. We will address requests within the periods required by applicable law.

Where a right of appeal applies, you may email secure@nullbrick.ai with the subject “Privacy appeal” to request review of a decision. You may also contact the relevant privacy regulator where applicable. We will not unlawfully discriminate against you for exercising your privacy rights.

Nullbrick is intended for businesses and professional users aged 18 or older and is not directed to children. Contact secure@nullbrick.ai if you believe a child has provided personal information.

Third-party sites and services, including a customer’s identity provider, have their own privacy practices. This policy does not govern their independent handling of information.

We may update this policy to reflect changes in our practices or legal requirements. We identify the effective date and last-updated date above and send material policy updates by email to the designated customer contact, with any additional notice required by law.

Nullbrick LLC, 2050 Cherrywood Ln, Cumming, GA 30041, USA. Email: secure@nullbrick.ai.