Flint AI

GDPR overview

GDPR implementation is documented in concrete terms. A Data Processing Addendum, last updated 9 July 2026, is published in the documentation and readable without an account; it invokes Article 28 and sets explicit roles - customer as Controller, SandboxAQ as Processor. Transfers outside the EEA rely on the 2021 Standard Contractual Clauses, module 2, with a UK IDTA addendum. Personal data breaches are notified within 72 hours. Subprocessor changes are announced 30 days ahead, with 15 days to object. Customers may audit once a year, on 30 days' notice and at their own cost, or accept third-party reports instead. Access, rectification, erasure, restriction, portability and objection rights are listed and exercised at privacy@sandboxaq.com, with personal data deleted within 30 days of termination. Two gaps: no Article 27 EU representative is designated and no DPO is named. The privacy notice is the group's, issued by SB Technology, Inc. d/b/a SandboxAQ.

Who owns the data?

Under the SandboxAQ EULA (section 7c), the licensee retains all intellectual property rights in the Customer Data it uploads or inputs and in the outputs the software generates for it; Usage Data is the stated exception. SandboxAQ receives a non-exclusive, worldwide, royalty-free, sublicensable and transferable license, limited to the License Period and to the sole purpose of providing the software. In the DPA, the customer is Controller and SandboxAQ is Processor. For the CLI, the publisher states there is no backend, no telemetry server and no account system: source code never leaves the machine. On exit, an export can be requested in writing within 30 days, followed by a deletion certificate on request.

Reuse rights

The licensee owns the outputs and may reuse them without asking permission, within the EULA's use restrictions and its ban on Prohibited Data (secrets, health data, payment cards, identity numbers, GDPR special categories). On the publisher's side, Flint AI Platform collects names, emails and user IDs, encrypted API keys, session tokens, repository metadata, code snippets (typically 100-500 characters), commit information, agent prompts, LLM responses, model identifiers, guardrail violations, IP addresses, session IDs and trace IDs; the publisher states it never captures whole source files, only snippets showing where agents are used. EULA section 7(b) lets SandboxAQ keep anonymized Usage Data in perpetuity to develop, maintain and improve its products and services. With the CLI, file discovery, static analysis (bandit, opengrep, detect-secrets, pip-audit) and the PII, secrets, toxicity and Garak detectors all run locally; only what is sent to the configured LLM provider leaves the machine - code snippets, import chains, file contents, findings with their context, adversarial prompts and the responses to be judged. Anonymous CLI telemetry is opt-in, asked at first launch, and never includes code, file paths, prompts, model responses, findings or API keys. Nothing published states whether customer data is used to train models.

Data retention & training

Hosting summary

The published subprocessors are Amazon Web Services and Google Cloud Platform, both listed as located in the 'United States, European Union'. The United States is designated as the primary infrastructure location; the European Union applies only when an EU region is chosen, and 'when available'. Data is encrypted in transit with TLS 1.2 or above and at rest with AES-256 or equivalent, and API keys are encrypted before storage. Access controls follow least privilege, with RBAC and mandatory MFA for production access. Network protections listed are firewalls, segmentation, intrusion detection, DDoS protection and 24/7 monitoring. Any change of subprocessor is notified 30 days in advance. The CLI is a separate case: it runs on the user's own machine and the publisher stores nothing, so the only outbound flow is what goes to the LLM provider whose key the user supplies. Transfers outside the EEA are covered by the 2021 Standard Contractual Clauses, module 2, with a UK IDTA addendum.