Security and data handling

1. The scan (CLI)

The scan runs locally with read-only tools. Before anything uploads, a trust report shows the exact artifact. It contains only:

• Product identity: name, one-line description, framework, language.
• Routes (paths and descriptions) and component names with roles.
• Customer-facing copy strings, with file locations.
• Brand voice (tone, keywords), workflows and their steps, coverage gaps.

Your source code, file contents beyond the excerpted UI strings, .env files, secrets, and git history never leave your machine. Model calls during the scan go through your Holostaff workspace, so you hold no model keys.

2. The runtime (SDK in your product)

The autopilot acts from what is on screen. To see the page, the SDK records the page structure and visible text and streams it to your Holostaff workspace while a session is active.

• Password, email, and phone inputs are always masked. Nothing typed into them leaves the browser.
• Mark any rendered personal data with the holostaff-mask class (masked) or holostaff-block class (not captured at all).
• Nothing is sent until the user's first real interaction. Bots and bounces send nothing.
• Set observe: { enabled: false } at init to turn capture off for a host entirely.
• The SDK talks to one host: your Holostaff workspace API. No third-party trackers.

During a handover, the recorded page is replayed in an isolated environment so the agent can decide the next action. That environment holds no credentials: the autopilot never types into password, payment, or code fields, and consequential actions wait for the user's inline Allow. Third-party model providers receive only the page content needed for a decision, under terms that do not permit training on your data. Your code is never sent to a model provider by the runtime.

3. Rehearsals (synthetic users)

Synthetic users run against the URL you set for a source. Point it at staging. They use the accounts you provision. Runs are recorded so you can watch them; each recording lives with the run in your workspace.

4. Where data lives

• All customer data is hosted in the United States. Primary region: Iowa (us-central1), where application servers, database, file storage, and authentication run. Scan-time model calls and page mockup rendering run in Virginia (us-east-1).
• Data is encrypted in transit (TLS) and at rest.
• No EU or other regional hosting option is offered today.

5. Retention and deletion

• Session recordings are streamed for replay and not stored by us as a permanent archive. Agent decisions and handover logs (what was clicked, what was asked, what was approved) are kept with the session for the life of your workspace so you can audit them.
• Rehearsal recordings are kept with the run for the life of your workspace.
• Deleting a source removes its map and compiled autopilots. To purge sessions, recordings, or an entire workspace, email security@holostaff.ai; we complete deletion within 30 days and confirm.
• Time-based automatic retention limits are not yet configurable per workspace. If you need a fixed window, tell us and we will set it manually.

6. Agreements and compliance

• A Data Processing Agreement is available on request for Team and Growth plans.
• We do not sign Business Associate Agreements and Holostaff is not intended for protected health information. Block PHI from capture with holostaff-block or disable capture for those hosts.
• No SOC 2 or ISO 27001 report yet. Holostaff is in alpha; we will publish audit status here when it exists.

7. Access and reporting

• Workspace data is scoped per tenant. Staff access is limited to support cases you open.
• Report a vulnerability to security@holostaff.ai. We acknowledge within 2 business days. Please do not test against other customers' workspaces.
• The CLI, SDK, and GitHub Action are open source under Apache-2.0 so you can read what runs on your machine and in your product.