Privacy Policy

1. Who we are

This Privacy Policy explains how Castawaze LLC ("we", "us", "our"), which operates Opsybots (the "Service") at app.opsybots.com, collects, uses, shares, and protects personal data in connection with the hosted Service. For the personal data we process to provide the hosted Service, Castawaze LLC is the data controller.

When we use capitalized defined terms in this Policy — such as Service, Workspace, Connected Account, Customer Account Metadata, Findings, Authorized User, Plan, and Sub-processor — they carry the meanings given in our Terms of Service and as glossed here. In particular:

• "Findings" are the results the Service renders from your AWS environment: AWS infrastructure metadata such as resource configurations, IAM settings, cost and usage figures, and security posture. Findings are infrastructure metadata, not your application data, and are not intended to contain personal data or protected health information (PHI).
• "Customer Account Metadata" is the underlying AWS infrastructure metadata that the Service reads from a Connected Account in order to produce Findings. Like Findings, it is infrastructure metadata, not application data, and is not intended to contain personal data or PHI.

A note on the open-source edition. Opsybots also ships as a public, open-source, single-account edition of the dashboard that you can run entirely within your own infrastructure. That edition collects nothing about you and sends us no data; this Policy does not cover it. This Policy covers only the hosted Service that we operate at app.opsybots.com.

You can reach us using the contacts below.

Castawaze LLC — Opsybots
Privacy & data requests: privacy@opsybots.com
Legal notices: legal@opsybots.com
Security disclosures: security@opsybots.com
Support & billing: support@opsybots.com

2. Scope

This Policy applies to the hosted Service that we operate at app.opsybots.com, including the hosted dashboard, account sign-up and authentication, billing, teammate invitations, and the cross-account read-only connection used to render Findings. It describes the personal data we process as a controller in order to provide that hosted Service.

This Policy does not apply to:

• the open-source, single-account edition of Opsybots that you self-host (it collects nothing about you);
• your own AWS account, the Customer Account Metadata in it, or the Findings derived from it (these stay in your environment — see Section 3); or
• third-party websites or services that we link to but do not operate.

3. What we collect

3.1 The data we collect and store ("controller data")

The hosted Service is deliberately narrow about what it stores. We store the account-administration data needed to operate the Service, secure it, and bill for it. We do not store your Findings or the weekly reports derived from them; those stay in your own AWS account (see Section 3.2). The table below is the complete inventory.

In plain terms, the personal data we hold is your identity and login details (name, email, MFA secret, and session cookies), the records that define your Workspace and who may access it (Workspace records and Memberships), the configuration that lets us connect read-only to your AWS account (Connected Account configuration, with the cross-account ExternalId encrypted at rest using AWS KMS), your billing identifiers (Stripe customer ID, subscription ID and status, and your plan tier and its Connected-Account quota), any teammate invitations you send (the invitee's email, a hashed token, and the invitation's status), and signup-attempt logs (IP address and timestamp) that we keep to prevent abuse. Payment card details are handled by Stripe; we never receive or store full card numbers. We hold no copy of your Findings and no copy of your weekly reports (see Section 3.2).

3.2 What stays in your account

This is the most important point about how the hosted Service handles your AWS environment, so we state it plainly, including the part that is less convenient for us.

Your findings history stays in your account. Opsybots' scanning agents run inside your own AWS account, are strictly read-only, and write Findings to your own storage in your account. The S3 bucket the stack creates is the system of record, it is encrypted with AWS KMS, and it is yours. The findings explorer reads it live from your account every time you open it, and nothing in the explorer is cached on our side. CSV export runs entirely in your browser. Suppressions are written back to that same bucket in your account, and nowhere else.

Your weekly reports stay in your account too. Once the weekly brief has been composed, it is written back to that same bucket in your AWS account, under a _reports/ prefix alongside the Findings and encrypted with the same AWS KMS key. The report archive, the individual report permalinks, and the trend charts are all served by reading those objects back out of your bucket. Each stored report holds counts and posture by severity and by pillar, the week's cost totals, the brief's narrative prose, and the week's top findings with their titles, recommendations, severities, estimated monthly cost impact, tags, and the identifiers of the resources involved.

We set no expiry on them. Reports accumulate in your bucket for as long as you want them. If you would rather they aged out, that is an S3 lifecycle rule you add on your own terms. Retention of your reports is yours to set, not a period we choose, and we run no job that deletes them.

Every item in a report is infrastructure configuration metadata. An identifier names a resource; it does not describe what is inside it, because nothing in Opsybots ever reads what is inside it.

So, plainly: your findings history and your report archive both stay in your own AWS account, encrypted with your own key, under your own retention. We operate the control plane that manages visibility, scheduling, suppressions, and delivery; we do not hold a copy of the content. The one exception is a transit path rather than a stored copy, and it is described next.

3.3 Where the weekly brief is composed

The agents run their AI review on Amazon Bedrock inside your own AWS account, using your credentials. The weekly brief does not. It is composed by the hosted dashboard, so that model call runs on Amazon Bedrock in the Opsybots AWS account in us-east-1, using our credentials rather than yours. A bounded slice of your data goes to it so it can write the prose:

• the week's counts, cost totals, posture, and per-pillar status, including the names of the agents that ran;
• your configured organization context;
• the week's top 25 candidate findings; and
• for each pillar's detail section, up to six further findings from that pillar. These overlap with the top 25 rather than being wholly additional, so the total number of distinct findings sent is a few dozen at most.

Each finding sent carries its title, recommendation, severity, resource identifiers, estimated monthly cost impact, tags, and internal finding, agent, and pillar identifiers.

This is a transit path, not a stored copy: the data is read into memory to compose the brief, the resulting report is written back to your own S3 bucket, and we retain no copy of either the inputs or the output. It is Amazon Bedrock in both cases, so your Findings are never sent to a third-party model API and are never used to train a model. If your requirements put a hard boundary around where processing happens, this is the part to check against them, and it is the one place the hosted Service reaches outside your account to do work. See /legal/subprocessors for the details.

4. How and why we use your data, and our legal bases

We process the controller data in Section 3.1 only for the purposes described here. For data subjects in the European Economic Area (EEA) and the United Kingdom (UK), the legal basis for each purpose under Article 6 of the GDPR (and the UK GDPR) is identified below.

• Providing the Service and your account (legal basis: performance of a contract, Art. 6(1)(b)). We use your name, email, MFA secret, and session cookies to create and secure your account, authenticate you, and let you sign in. We use your Workspace records and Memberships to operate your Workspace and enforce roles and access control. We use your Connected Account configuration — including the KMS-encrypted cross-account ExternalId, account ID, resource prefix, stack name, regions, enabled agents, and status — to establish and maintain the read-only cross-account connection that lets the Service render your Findings on demand.

• Composing and delivering the weekly brief (legal basis: performance of a contract, Art. 6(1)(b)). We use your Connected Account configuration to read your Findings on an automated schedule, compose the weekly brief, and write the resulting report back to your own S3 bucket as described in Section 3.2, so that the brief, the report archive, and the trend charts work. We use your email address and your Memberships (including your weekly-email preference and unsubscribe token) to deliver the brief by email, and, where an admin has configured it, the Workspace's KMS-encrypted Slack webhook URL to deliver the digest to your own Slack workspace.

• Inviting teammates (legal basis: performance of a contract, Art. 6(1)(b)). When you invite a teammate to your Workspace, we process the invitee's email, a hashed invitation token, and the invitation's status to deliver and manage the invitation.

• Transactional email (legal basis: performance of a contract, Art. 6(1)(b)). We use your email address to send service-related messages such as account confirmation, password and login messages, MFA notices, invitation emails, and billing notices. These are not marketing emails.

• Billing and payments (legal basis: performance of a contract, Art. 6(1)(b); and compliance with a legal obligation, Art. 6(1)(c)). We use your Stripe customer ID, subscription ID and status, and your plan tier to bill your Workspace for its Plan and to manage your subscription. Plans are priced by the number of Connected Accounts included, not by the number of Authorized Users, so we do not count or bill for people. Stripe processes your payment card details on our behalf; we never receive or store full card numbers. We retain certain billing records longer than the rest of your account data where we must do so to meet tax and accounting obligations.

• Abuse prevention and rate-limiting (legal basis: legitimate interests, Art. 6(1)(f)). We log signup attempts (IP address and timestamp) to protect the Service against automated abuse, fraudulent or duplicate sign-ups, and similar threats. Our legitimate interest is keeping the Service secure and available; we keep these logs only briefly (see Section 7) and they are not used to profile you.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we do not use it for advertising.

5. How we share your data / Sub-processors

We do not sell your personal data, and we do not "share" it for cross-context behavioral advertising. We disclose personal data only in the limited circumstances below.

• Sub-processors. We use a small set of trusted service providers ("Sub-processors") to host and run the Service. Our Sub-processors are:

  • Amazon Web Services (AWS), hosting and infrastructure, AWS Cognito for identity and authentication, Amazon SES for transactional email and the weekly report email, Amazon RDS for the control-plane database that holds the account-administration data in Section 3.1, and Amazon Bedrock for AI inference;
  • Stripe — subscription billing and payment processing; and
  • Postmark — receives aggregate DMARC reports only (email-authentication summaries); it does not receive your personal data and is listed for transparency.

  Sub-processors process personal data only on our instructions and under contractual confidentiality and security obligations. The authoritative, current list — with each Sub-processor's role and processing details — is maintained at /legal/subprocessors.

• Slack (only if you turn it on). If an admin in your Workspace configures Slack delivery, we post the weekly digest to the incoming-webhook URL they provide, which points at your own Slack workspace. This is the one path where content leaves AWS. The digest's prose, headline figures, and top priorities transit Slack's servers and come to rest in your Slack workspace, under your agreement with Slack and Slack's retention, not ours. We design the digest not to name individual resources: the model that writes it is instructed to keep resource identifiers out of its prose, and we remove identifiers we detect before the digest is sent. Treat that as a design intent rather than a guarantee, because a priority's heading can be drawn from the underlying finding, which may name the resource it concerns. What is never sent is the full list of affected resources; to see which bucket or which key, you follow the link into the dashboard. Slack delivery is off unless an admin turns it on, and removing the webhook stops it. Because you choose the destination, configure it, and can revoke it, Slack acts on your instruction rather than as a Sub-processor we have engaged; see /legal/subprocessors.

• Legal and safety disclosures. We may disclose personal data when we reasonably believe it is required to comply with applicable law, a lawful request from a public authority, or legal process, or to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Castawaze LLC, our users, or the public.

• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to the protections of this Policy. We will notify you of any such change in control where required by law.

We do not sell your personal information, and we do not "share" it in the sense those terms are used under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA/CPRA"). We do not engage in cross-context behavioral advertising.

6. International data transfers

We process and store personal data in the United States. If you access the Service from the EEA, the UK, or another jurisdiction with data-transfer rules, your personal data will be transferred to and processed in the United States.

For personal data of data subjects in the EEA and the UK, where the transfer would otherwise lack an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum, as applicable) as the legal mechanism for the transfer. These clauses are incorporated into our Data Processing Addendum, available at /legal/dpa. You may request a copy of the relevant transfer safeguards by contacting us at privacy@opsybots.com.

7. Data retention

We retain account-administration data while your account is active. After your account is closed, we delete or anonymize that data within thirty (30) days, except where we must keep certain records (for example, billing and tax records) longer to meet legal obligations. Signup-attempt logs, including IP addresses, used for abuse prevention are deleted within ninety (90) days. Your Findings and your weekly reports stay in your own AWS account under your own retention, so there is nothing of that kind for us to return or delete, and no retention period of ours applies to them.

8. Security

We take a defense-in-depth approach to protecting the controller data we hold and the read-only connection to your AWS account:

• Encryption at rest. Sensitive controller data is encrypted at rest using AWS Key Management Service (KMS). In particular, the cross-account ExternalId in your Connected Account configuration, and the Slack webhook URL if you configure one, are encrypted with AWS KMS. The control-plane database is encrypted at rest, runs in a private subnet and is not publicly reachable, and scopes every row to a single Workspace. Your Findings and your weekly reports are not in that database at all: they are in your own S3 bucket, encrypted with your own KMS key.
• Encryption in transit. Traffic to and from the Service is protected with TLS.
• Read-only, least-privilege cross-account access. The role you grant the Service into your AWS account is read-only and is scoped to what is needed to read your Findings. The agents that scan your account are strictly read-only and never modify your resources.
• Authentication and access control. We use AWS Cognito for authentication, support optional TOTP multi-factor authentication, and enforce role-based access control within each Workspace.
• Email integrity. Outbound email is sent through Amazon SES with bounce and complaint suppression and DMARC enforcement to protect against spoofing and to maintain deliverability.

You must not submit, expose, or cause the Service to process protected health information (PHI) or other specially regulated data. Customer Account Metadata is intended to be infrastructure metadata only; do not direct the Service at data requiring a Business Associate Agreement or similar arrangement (see our Terms of Service).

No method of transmission or storage is perfectly secure, and we do not and cannot guarantee absolute security. We do, however, work to protect your data using the measures above and to respond promptly to security issues. To report a vulnerability or a suspected security problem, contact security@opsybots.com.

9. Your rights

Depending on where you live, you may have rights over your personal data. We honor these rights for the controller data described in Section 3.1. Your Findings and your weekly reports stay in your own AWS account, under your own control, so there is nothing of that kind for us to access, correct, export, or delete on your behalf.

9.1 EEA and UK (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the right to:

• access your personal data and obtain a copy of it;
• rectify inaccurate or incomplete personal data;
• erase your personal data ("right to be forgotten"), subject to legal exceptions;
• restrict our processing of your personal data in certain circumstances;
• data portability — receive your personal data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible;
• object to processing based on our legitimate interests; and
• withdraw consent at any time where we rely on consent (without affecting processing already carried out).

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence or place of work, or in the UK with the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first — please contact us at privacy@opsybots.com.

9.2 California (CCPA / CPRA)

If you are a California resident, you have the right to:

• know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to whom we disclose it;
• delete personal information we have collected from you, subject to legal exceptions;
• correct inaccurate personal information;
• opt out of the "sale" or "sharing" of your personal information — note that we do neither; we do not sell your personal information and we do not share it for cross-context behavioral advertising;
• limit the use and disclosure of sensitive personal information — we use such information only for the permitted business purposes of providing and securing the Service, not to infer characteristics about you; and
• non-discrimination — we will not discriminate or retaliate against you for exercising any of your privacy rights.

You may exercise these rights as described in Section 9.4. You may use an authorized agent to submit a request on your behalf, subject to our verifying the agent's authority.

9.3 Texas (TDPSA)

If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA), including the rights to access, correct, and delete your personal data, to obtain a portable copy of it, and to opt out of certain processing such as targeted advertising, the sale of personal data, and certain profiling. As noted above, we do not sell personal data, engage in targeted advertising, or profile you. Please note that some provisions of the TDPSA apply only to businesses that meet the Act's thresholds; we honor these rights for the controller data described in this Policy to the extent the Act applies to us.

9.4 How to exercise your rights

To exercise any of the rights above, email us at privacy@opsybots.com. To protect your data, we will take reasonable steps to verify your identity before acting on a request — typically by confirming that you control the email address associated with your account, and we may ask for additional information where needed to match you to your records. We will respond within the timeframe required by applicable law (generally within thirty (30) to forty-five (45) days, with a permitted extension where the request is complex), and we will tell you if we need more time. Exercising your rights is free, except where a request is manifestly unfounded or excessive, in which case applicable law may permit a reasonable fee or refusal.

10. Cookies

The hosted Service uses only essential authentication cookies — specifically, the httpOnly id, access, and refresh session cookies that keep you signed in. These cookies are strictly necessary to provide the Service and to authenticate you.

We do not use advertising cookies, analytics cookies, or third-party tracking cookies, and we do not use cookies to profile you across sites. Because the only cookies we set are strictly necessary, no cookie consent banner is required.

11. Children's privacy

The Service is a business tool that is not directed to, and is not intended for, anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@opsybots.com and we will take appropriate steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time — for example, to reflect changes in the Service, our Sub-processors, or the law. When we make a material change, we will notify you by email or through an in-app notice before the change takes effect, where required by law. The Effective Date at the top of this Policy indicates when the current version takes effect, and your continued use of the Service after the Effective Date constitutes acceptance of the updated Policy. We encourage you to review this Policy periodically.

13. Contact and representatives

For privacy questions, to exercise your rights, or for any other request relating to your personal data, contact us:

Castawaze LLC — Opsybots
Privacy & data requests: privacy@opsybots.com
Legal notices: legal@opsybots.com
Security disclosures: security@opsybots.com
Support & billing: support@opsybots.com

EU/UK representative. We do not currently maintain an establishment in the EEA or the UK. If and when we become legally required to designate a representative under Article 27 of the GDPR or the UK GDPR, we will appoint one and update this Policy with their contact details.