HiddenLayer’s Product Data Collection and Handling

Our Commitment to Data Transparency and Protection

Your trust matters to us. Our approach to data protection is grounded in transparency, strong security practices, and clearly defined safeguards. This document explains what data is collected, how it is used to support and deliver product functionality, and how it is protected at every stage. We are committed to being open about our data practices so you can make informed decisions, maintain control of your information, and confidently use our products knowing privacy and security are built in from the start.

Our Commitment to Safeguard Your Data

Data Ownership

Customers retain full ownership and control of their data at all times.

Defined Retention and Secure Deletion

Retention periods are clearly defined by product and secure deletion practices are enforced.

Data Minimization and Purpose Limitation

We collect only the data necessary to fulfill contractual, legal, and regulatory requirements—minimizing exposure while supporting compliance.

Audits and Oversight

Regular audits validate retention enforcement, access controls, storage protections, and responsible data classification.

Protection of Personal Information

We implement administrative, technical, and organizational safeguards to protect personal information against unauthorized access, alteration, disclosure, or destruction, in line with industry-accepted security practices.

Sub-Processors & Third-Party Providers

HiddenLayer engages trusted sub-processors to support delivery of our products and services. Any sub-processor involved in the storage or processing of customer data undergoes security and privacy due diligence and is required to meet our information security standards. A current list of sub-processors is available to customers upon request.

Role-Based Access Control (RBAC)

Access is managed through centralized RBAC with permissions assigned by role and regularly reviewed to enforce least privilege and segregation of duties.

Rapid Incident Response

Our incident response process ensures clear communication, timely action, and continuous improvement.

Encryption by Default

All data in transit is encrypted using secure industry standards. All data at rest is encrypted using AES-256 or stronger. HiddenLayer uses the secure HTTPS protocol for all data transmission between users, the console, and external integrations over public networks.

Data Scope and Boundaries

Personal Information

Personal information is only collected where necessary to support account management, access control, billing, or customer support, and is rarely required for core product functionality.

We retain personal information only as long as needed to fulfill the purposes for which it was collected, and for a limited period afterward to meet legal, contractual, or audit requirements. De-identified or aggregated data may be retained where permitted. Backup and archival copies may persist for a defined period as part of standard system operations.

What Data is Not Collected

HiddenLayer does not collect:

Customer training datasets
Business logic or proprietary application code
Persistent copies of model files, including model weights
Customer data for training or tuning without explicit authorization

What Data Is Processed and Stored

HiddenLayer processes and stores data in secure environments aligned with the selected deployment model. Data location and processing controls are designed to meet security, compliance, and customer requirements.

When deployed in SaaS mode, certain data resides within HiddenLayer’s tenant-isolated infrastructure. In hybrid deployment models, some data may be processed locally within the customer environment while selected results or metadata are transmitted to the SaaS platform.

Platform Operational Data

Operational data is collected and protected to ensure secure access, maintain platform integrity, support compliance requirements, and provide auditable oversight of system activity.

Identity and Access Management (IAM) Data

Authentication credentials, user roles, authorization data, and user identifier, including name and e-mail address, used to securely manage access and enable approved third-party integrations.

Product Usage and Configuration Data

Platform interaction data, configuration settings, and usage patterns used to maintain performance, improve functionality, and support customer operations.

Access Logs and Audit Trails

Logged records of user and system activity used for security monitoring, compliance reporting, and incident investigation.

AI Runtime Security

Runtime Security ingests and analyzes structured:

Runtime Interaction Data

Prompts and system messages, model outputs, tool/function calls and results, session metadata, and multimodal content.

This data is used to reconstruct sessions, detect adversarial activity and policy violations, and apply runtime actions such as detect, redact, or block. Detection records include the triggering signals, related execution context, and applied policy outcome.

For customer-controlled deployments, monitoring and enforcement can be deployed within the customer environment. Customer data is not used for model training. Any contribution to detection enhancement requires explicit customer approval.

In the SaaS deployment model, detection data is retained for a rolling 30-day window. Following contract termination, all data is securely deleted within 60 days.

AI Supply Chain Security

Supply chain data is processed and protected to assess model integrity, provenance, licensing exposure, and deployment risk before models enter production environments without expanding intellectual property exposure. We intentionally work with structured metadata and security attributes that do not allow reconstruction of the model. This enables vulnerability detection, license transparency, provenance validation, and informed, risk-based deployment decisions while maintaining strict protection of proprietary model assets.

Model Inventory and Discovery Metadata

Structured records of identified models within your environment, including reference attributes used for governance and oversight.

Model Lineage and Supplier Information

Genealogy data mapping upstream dependencies, publisher sources, and supplier relationships.

File Hashes and Structural Metadata

Cryptographic hashes and file-level attributes used to validate integrity and detect tampering or known vulnerabilities.

Model Intelligence Data

Includes license used to evaluate commercial use rights and compliance obligations, as well as geographic footprint and country of origin used to assess jurisdictional and geopolitical risk.

Vulnerability Scan Results

Detection findings identifying security weaknesses, embedded risks, or unsafe components within model artifacts.

AI Bill of Materials (AIBOM) Data

Component-level transparency detailing model composition and dependencies to support audit and governance requirements.

License Metadata

Structured licensing information used to evaluate commercial use rights and compliance obligations.

Raw model files are temporarily stored solely for processing and automatically deleted within 24 hours.

Model weights are not inspected, retained, or reused.

AI Discovery

AI Discovery data is processed and protected to provide visibility into AI-related assets across cloud environments, supporting governance, supply chain, inventory management, and risk oversight without expanding customer data exposure. We focus on asset-level metadata and configuration attributes necessary to identify and classify AI systems within your environment.

Customer Identity & Access (IAM) Data

Authentication credentials, roles, and authorization data used to securely access and enumerate AI-related assets.

Cloud Provider Asset Metadata

Cloud environment metadata identifying AI models, services, endpoints, and associated configurations.

Product-Generated Asset Intelligence

Structured discovery records generated by the platform to support centralized AI inventory and oversight.

Source asset data is retained for the life of the customer relationship to support discovery visibility, continuous governance, and asset management.

AI Attack Simulation

AI Attack Simulation data is processed and protected to evaluate system prompt resilience, identify security gaps, and strengthen AI system defenses prior to deployment. Processing is limited to authorized testing inputs, structured analysis outputs, and product-generated security enhancements.

Original System Prompts (Customer IP)

User-submitted system prompts analyzed for security weaknesses and vulnerability exposure.

Targeted Question Responses

User-provided responses used to refine analysis and strengthen prompt resilience.

Enhanced System Prompts (Product-Generated)

Security-hardened prompts generated by HiddenLayer to improve defensive posture.

Security Updates & Explanations

Structured updates and improvement summaries detailing remediation and hardening actions.

Red Teaming Configuration & Prompt Sets

Testing objectives, evaluation parameters, pre-configured or generated prompts, and associated model responses used to simulate adversarial behavior.

Red Teaming Evaluation Results

Structured findings including tactics, techniques, success rates, and assessment summaries used to validate security posture.

All AI Attack Simulation data is retained for 90 days unless otherwise contractually required. System prompts and associated artifacts are processed solely for analysis and defense improvement purposes.

Summary of Our Approach

AI security requires visibility, and that visibility must be handled responsibly. HiddenLayer is designed to provide the insight necessary to detect threats and assess model risk while maintaining clear data boundaries, defined retention practices, and strong access controls. Our approach is intended to give you the clarity, control, and confidence needed to manage AI risk within your own governance and compliance frameworks.