Vigil Guard Enterprise

GDPR overview

GDPR is claimed explicitly and in several places: the home page headline, the Risk and Compliance block and llms.txt all describe the offering as GDPR-compliant. The privacy policy lists the full set of rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent), commits to a 30-day response and gives one point of contact, contact@vigilguard.ai. It also documents encryption in transit and at rest, and permits transfers outside the EEA under the European Commission's standard contractual clauses, which is a transfer clause for website data and not a statement about where the platform is hosted. The publisher is established in Poland, so no Article 27 representative is required. No DPO is named, no DPA is published and no certification of any kind is claimed. The product-side argument is structural: an on-premise install sends no data to the publisher.

Who owns the data?

Two perimeters have to be kept apart. On the marketing website, Vigil Guard is the declared controller of the data you submit through the contact form, reachable at contact@vigilguard.ai. On the product side the question barely arises: the entire platform runs on your own infrastructure as a Docker Compose stack, with no external API calls, no cloud telemetry and no phone-home mechanism, so your prompts, your logs and your policy configuration stay on your side. Detection models ship inside the container images and run locally on CPU. Scope Definitions are AES-encrypted at rest with key rotation, and the audit log keeps only a SHA-256 fingerprint, never the plain text. No terms of service are published; the EULA appears only at install time.

Reuse rights

On the website, form data (name, email, company, job title) is used to answer your enquiry, to send product communications, to improve the site and to meet legal obligations, on the basis of legitimate interest and, for marketing, of consent. The privacy policy states plainly that “We do not sell your personal data”; it is shared only with categories of providers (hosting, email), with professional advisers and with authorities where the law requires it, and analytics are described as privacy-respecting, with no third-party tracking cookies. Inside the platform, the reuse question turns around: nothing reaches the publisher, so the detection logs, the audit trail and the analytics database are yours to query, export and reuse without asking anyone. False positives your team flags are indexed in a local vector memory that adjusts future scores, with no model retraining; the PromptGuard v4 models are presented as trained on adversarial data the publisher generates itself.

Data retention & training

Hosting summary

The platform is not hosted by the publisher at all. “The entire platform runs on your infrastructure as a Docker Compose stack”, on a Linux x86_64 host you control, with no external API calls, no cloud telemetry and no phone-home mechanism; a fully air-gapped installation is supported. All ML models ship inside the container images, and inference is local, on CPU, without a GPU. The only network access required, and only during installation, is to Docker Hub in order to pull and verify the images. Jurisdiction therefore follows your own hosting decision: no hosting country and no region is named anywhere on the site, which is why those fields are left empty here. The marketing website is a separate matter, served behind Cloudflare (104.21.8.187, AS13335, anycast), which tells you where the brochure lives and nothing about where your prompts are processed. The privacy policy's clause permitting transfers outside the EEA under standard contractual clauses applies to website form data only, and names no country.