Bounded Security

Bounded Security Privacy Policy

Last updated: May 30, 2026
Effective date: May 30, 2026

This Privacy Policy ("Policy") describes how Bounded Security ("Bounded," "we," "us," or "our") collects, uses, discloses, stores, and protects information in connection with the Bounded AI-security platform, including the website at bounded-security.com, the security console at platform.bounded-security.com, the Bounded browser extension, the Bounded desktop sensor, the Bounded backend services, and any related applications, APIs, integrations, and connectors (collectively, the "Services").

Brand notice. "Bounded Security" is a product and brand name. As of the effective date of this Policy, Bounded Security is operated as an unincorporated venture and is not a registered legal entity. References to "Bounded," "we," "us," or "our" refer to the operators of the Bounded Security brand and the Services. Nothing in this Policy shall be construed as a representation that any specific corporate entity exists, and this Policy will be updated to identify the operating legal entity if and when one is formed.

By accessing or using the Services, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, do not access or use the Services.

1. Who this Policy covers

The Services are an enterprise, business-to-business security product. They are designed to be deployed by an organization (the "Customer" or "Organization") to discover, monitor, and enforce security policy over AI tools - browser extensions, desktop AI agents, MCP servers, code dependencies, and connected SaaS applications - operating within that Organization's environment.

This Policy distinguishes between:

Important for end users: If your employer or another organization has deployed the Services on a device, browser, or account you use, that organization - not Bounded - determines what is monitored, why, and for how long the resulting data is retained within the limits the Services allow. Please direct questions about that organization's monitoring practices to the organization. Bounded processes such data on the organization's behalf.

2. Scope and relationship to other agreements

This Policy supplements, and is incorporated into, any master services agreement, order form, enterprise agreement, terms of service, or data processing agreement ("DPA") between Bounded and a Customer. Where a separately negotiated written DPA or enterprise agreement exists between Bounded and a Customer, that agreement governs to the extent of any conflict with this Policy. In the absence of such an agreement, this Policy governs.

This Policy does not apply to:

3. Information we collect

The Services are purpose-built to detect security risk. By design, we seek to minimize the collection of personal data and to avoid storing raw sensitive content wherever the security objective can be achieved with masked, fingerprinted, or metadata-only representations. The categories below describe what may be collected depending on which components an Organization deploys and how it configures them.

3.1 Account, tenancy, and licensing data

3.2 Security telemetry and findings (the core of the Services)

Depending on the components deployed, the Services collect security-relevant signals such as:

3.3 Data Loss Prevention (DLP) detections

The DLP engine scans text - for example, content typed into web forms and GenAI prompts, repository files, email content, and SaaS application content - against a catalog of recognizers for credentials, secrets, and sensitive identifiers (including, among others, API keys and cloud tokens, database and basic-auth URLs, private keys, OAuth client secrets, storage connection strings, payment-card data, and personal, employee, customer, or patient identifiers).

DLP evidence is masked by design. The Services emit masked samples and stable fingerprints that allow an Organization to understand the nature and location of a detection without exposing the underlying secret or personal data. The Services are designed not to store raw DLP matches (the unmasked secret or full sensitive value) in SQL, in the document store, in security-event payloads, in connector metrics, or in audit logs. Real-time browser DLP scanning is performed on the user's device, and the extension can redact sensitive input locally before it leaves the browser.

3.4 Public vulnerability intelligence

The Services maintain a vulnerability catalog assembled from public-domain U.S. government feeds (such as CISA KEV, NIST NVD, and MITRE CVE Services). This catalog contains vulnerability metadata only and does not contain Customer personal data.

3.5 Website, product usage, and technical data

3.6 Communications

If you contact us (for example, by email or through a support channel), we collect the content of your communications and related metadata to respond and maintain records.

3.7 Information we do not intentionally collect

4. How we use information

We use information for the following purposes:

  1. To provide the Services - discovering, inventorying, scoring, and reporting on AI-related security risk; evaluating and enforcing Customer-defined policy; running scheduled and manual scans; and surfacing findings, events, and dashboards in the console.
  2. To operate authentication, tenancy, and licensing - authenticating users, enforcing access control and multi-tenant isolation, and managing licenses and entitlements.
  3. To secure the Services - detecting, investigating, and preventing fraud, abuse, unauthorized access, and security incidents; enforcing rate limits; and maintaining audit trails.
  4. To maintain, debug, and improve the Services - diagnosing errors, monitoring performance, and developing new and improved features and detections.
  5. To communicate with you - sending service, security, administrative, and transactional messages, and responding to inquiries.
  6. To comply with law - meeting legal, regulatory, tax, accounting, and contractual obligations, and establishing, exercising, or defending legal claims.

Use limitation. When Bounded acts as a processor/service provider, we process Customer data only to provide and support the Services and as otherwise permitted by the applicable agreement and law. We do not sell personal data, and we do not "share" personal data for cross-context behavioral advertising. We do not use Customer content to train generative AI models for unrelated purposes. Any use of aggregated or de-identified data is limited as described in Section 5.

5. Aggregated and de-identified data

We may create and use aggregated, anonymized, or de-identified data - including statistics derived from vulnerability intelligence, risk findings, and product usage - that does not identify any individual or Organization. We may use such data for any lawful business purpose, including operating, securing, benchmarking, and improving the Services and our threat intelligence. Where we de-identify data, we maintain the data in de-identified form and do not attempt to re-identify it except as permitted by law to test the effectiveness of de-identification.

6. Legal bases for processing (EEA/UK and similar jurisdictions)

Where data-protection law requires a legal basis, we rely on the following, as applicable:

Where Bounded processes data as a processor on a Customer's behalf, the Customer is responsible for establishing and maintaining a lawful basis for the processing it directs, for providing required notices to its personnel, and for obtaining any necessary consents.

7. How we share information

We do not sell personal data. We disclose information only as described below:

A current list of sub-processors is available to Customers on request and, where required by a DPA, we will provide advance notice of material changes to sub-processors and an opportunity to object.

8. Connector tokens and credentials

OAuth access and refresh tokens, sensor tokens, and similar credentials are treated as highly sensitive:

These credentials are used solely to perform the scans the Organization has authorized.

9. Data storage, location, and international transfers

The Services are hosted on Google Cloud Platform / Firebase under the project associated with the Bounded Security brand. The primary managed PostgreSQL database (Cloud SQL via Firebase Data Connect) and related compute are provisioned in the me-west1 region; certain serverless, caching, content-delivery, authentication, and logging components may process data in other regions in which our infrastructure providers operate.

If you access the Services from a jurisdiction different from where our infrastructure is located, your information may be transferred to, stored in, and processed in other countries whose data-protection laws may differ from those of your jurisdiction. Where such transfers are subject to data-protection law, we rely on appropriate safeguards (for example, Standard Contractual Clauses or equivalent mechanisms) as required. Customers requiring specific transfer terms should address them in a DPA.

10. Data retention

We retain information for no longer than is necessary for the purposes described in this Policy, after which it is deleted or de-identified, subject to the exceptions below.

Where Bounded acts as a processor, the Customer may configure retention within the limits the Services provide and may request deletion or return of Customer data on termination as set out in the applicable agreement. We may retain information for longer where required by law or to establish, exercise, or defend legal claims.

11. Cookies and similar technologies

The public website and the console use cookies and similar technologies (such as local and session storage) that are strictly necessary to provide core functionality, including authentication, session management, security, and load balancing. We may also use limited analytics or performance technologies to understand and improve the Services. Where required by law, we obtain consent for non-essential cookies and provide controls to manage them. You can also control cookies through your browser settings; disabling strictly necessary cookies may prevent the Services from functioning.

12. Your rights and choices

Depending on your jurisdiction and your relationship with us, you may have rights to access, correct, update, delete, restrict, or object to certain processing of your personal data, to data portability, and to withdraw consent. You may also have the right to lodge a complaint with a supervisory authority.

How to exercise rights:

We will respond to verifiable requests within the timeframes required by applicable law. We may need to verify your identity before acting on a request, and we may decline requests where an exception or legal obligation applies.

For California residents: We do not sell or share personal information as those terms are defined under California law, and we do not use or disclose sensitive personal information for purposes that would require a right to limit. You will not be discriminated against for exercising your privacy rights.

13. Children's privacy

The Services are intended solely for use by businesses and their authorized personnel and are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

14. Security

We implement administrative, technical, and organizational measures designed to protect information appropriate to its sensitivity, including: encryption of connector credentials at rest (AES-GCM), hashing of sensor tokens, encryption in transit (TLS/HTTPS), strict multi-tenant isolation enforced at the data layer, least-privilege access controls, masked-by-design handling of DLP and finding evidence, rate limiting, and audit logging. The sensor stores its local credential with restricted (0600) file permissions.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for safeguarding your account credentials and for configuring the Services appropriately for your environment. If we become aware of a security incident affecting personal data, we will notify affected Customers and, where required, individuals and regulators, in accordance with applicable law and the applicable agreement.

15. Third-party services and links

The Services integrate with and link to third-party platforms and may contain links to third-party websites. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy policies. Use of a third-party connector is subject to that platform's terms and the authorization granted by the Organization.

16. Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, provide additional notice (for example, through the console or by email to Customer administrators). Changes are effective when posted unless otherwise stated. Your continued use of the Services after an update constitutes acceptance of the revised Policy to the extent permitted by law.

17. Contact us

For questions, requests, or concerns about this Policy or our data practices, contact us at:

If you are an end user covered by an Organization's deployment of the Services, please first contact your Organization's administrator, who controls the relevant data.

This document describes the privacy practices of the Bounded Security brand and Services. It is provided for transparency and does not, by itself, create rights or obligations beyond those required by applicable law or agreed in a written contract between Bounded and a Customer.