Privacy Policy

Introduction

We treat information privacy as an ongoing responsibility, and we update this Privacy Notice from time to time as we adopt new data practices or policies.

Use of the HoundDog.ai Website (https://hounddog.ai)

When you complete a Contact Us or Book a Live Demo form, we collect your name, employer name, and work email. We use this data to provide services to prospects and customers. We do not sell personal information and only share it with third parties who facilitate our services.

Our third-party sub-processor for web forms is HubSpot. See the HubSpot Privacy Policy for details.

We do not share your personal data with non-HoundDog.ai entities unless:

• you request or authorize it
• it's for a HoundDog.ai-hosted or co-sponsored event
• it's required by law
• it's needed to enforce agreements or protect rights
• it's needed for emergencies or acts of God
• it's needed to resolve disputes or for authorized persons

We may also share aggregated, non-personally identifiable data with partners and service providers for marketing or promotional purposes.

Use of the HoundDog.ai Cloud Platforms

HoundDog.ai provides cloud-hosted platforms for the enterprise versions of the Privacy Code Scanner and Dataflow Context Engine, hosted on AWS with encryption in transit and at rest. PropelAuth is the subprocessor used to process authentication via the customer's own SSO (e.g., Okta, Microsoft Entra ID, Google Workspace, Microsoft Azure AD, and others), and only name, email, and IP address are shared accordingly. See PropelAuth's privacy notice for reference.

For both products, scanning happens in the customer environment, either via a local CLI that runs on a developer machine or as part of the customer's CI workflow (e.g., GitHub, GitLab, Bitbucket) where the customer chooses one of the SCM provider's cloud-hosted runners or their own privately hosted runners. Only the results are sent back to the cloud-hosted platform. In the privacy offering, the results include dataflow traces. In the engineering offering, the results include a service catalog along with all the APIs and fields used.

For local scanning (the free offering), both the scanning and the results remain completely local. For the enterprise offering, only the results are sent to a cloud-hosted platform, but the scanning happens locally. An on-prem enterprise platform is also available, where both scanning and results remain within the customer environment.

For more information on available deployment options, refer to the pricing page.

We support data subject access requests and can provide customer data in a readable, easily transferable format when required. We can permanently delete or erase an individual's information when a customer receives a removal request.

Transferring Personal Data to the U.S.

HoundDog.ai is headquartered in the United States, and personal information we collect is processed there. By using our services, you acknowledge this processing.

The United States has not received an "adequacy" finding from the European Union under Article 45 of the GDPR. Pursuant to Article 46, we provide appropriate safeguards through binding standard contractual clauses enforceable by data subjects in the EEA and UK, enhanced per European Data Protection Board guidance and updated as new model clauses are approved. We also sign data processing agreements with vendors where appropriate, and we transfer personal data only with consent, to perform a contract, or for a legitimate interest that does not outweigh your rights.

Since we were founded, we have received zero government requests for information. Questions: [email protected].

Data Subject Rights

The European Union's General Data Protection Regulation (GDPR) and other countries' privacy laws provide certain rights for data subjects, including:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right of data portability
• Right to object
• Rights related to automated decision making, including profiling

To exercise any of these rights, or to request information about how we process your personal data, email [email protected]. We provide reasonable access at no cost. If we cannot respond within a reasonable time, we will let you know when to expect a response. If access is denied, we will explain why. If you are located in the European Union, you may also contact the European Data Protection Supervisor or your national data protection authority.

Security Certifications and Measures

We achieved SOC-2 Type 2 certification. See the Trust Center for details. Our security and organizational measures include:

Access and authentication

• Multi-factor authentication for all remote access, including email
• User identification and authorization controls
• Quarterly access reviews for in-scope system components

Data protection

• Encryption of personal data in transit and at rest
• Data minimization across collection and processing
• Data portability and erasure on request

Monitoring and testing

• Regular penetration testing
• Event logging
• Continuous evaluation of technical and organizational controls
• Vulnerability and patch management program

Governance

• IT and security governance and management
• Consistent system configuration across the environment
• Vendor management program with annual reviews of critical third parties
• Incident response and recovery for personal data availability

Questions, Concerns, or Complaints

If you have questions, concerns, complaints, or would like to exercise your rights, please contact us at [email protected].