Privacy Policy

Introduction

Shrike, Inc. ("Shrike", "we", "us", or "our") operates the Shrike platform, including the API at api.shrikesecurity.com, the MCP server (shrike-mcp), SDKs (shrike-guard), the LLM Proxy Gateway, and the web dashboard at shrikesecurity.com (collectively, the "Service").

This Privacy Policy explains what data we collect, how we use it, how long we retain it, and your rights regarding that data. We are committed to minimizing data collection and protecting user privacy.

Data We Collect

When you use Shrike to scan content, we process:

• Scan payloads — The prompts, responses, SQL queries, commands, file paths, or agent messages you submit for scanning. Safe scans are retained as a cryptographic hash and metadata only — the original content is not stored. Content from blocked or flagged scans is retained to support threat analysis, incident response, and audit trails.
• Scan metadata — Timestamps, threat verdicts, detection layers triggered, session IDs, and agent IDs. Used for rate limiting, billing, and aggregate analytics.
• Account information — Email address, organization name, and authentication credentials (hashed) when you create an account.
• API keys — Generated keys are stored as salted hashes. We cannot recover your raw API key after generation.
• Usage data — Scan counts, tier usage, and billing metrics. No content is included.
• Public sandbox submissions — Content submitted to the public playground sandbox (no account required) is retained in full, together with IP address and browser user agent, as an abuse-prevention audit trail. This differs from authenticated scanning above: the sandbox is a shared demo surface, so use sample data rather than production secrets. An email provided to the sandbox API is stored to lift session rate limits.

Data We Do NOT Collect

• We do not access your previous conversations or chat history
• We do not access Claude's memory or any MCP client's stored state
• We do not collect data beyond what is necessary for the scan function
• We do not sell, rent, or share personal data with third parties for marketing
• We do not use your scan content to train machine learning models

PII Handling

Shrike detects personally identifiable information (PII) in scan payloads — including email addresses, phone numbers, social security numbers, credit card numbers, and other sensitive identifiers.

When PII is detected, the default action is redact, not block. PII is replaced with tokens (e.g., [EMAIL_1]) before any further processing. The MCP server and SDKs support client-side PII redaction, meaning PII can be stripped before it ever leaves your environment.

Data Retention

Deletion on request is available to every customer. Automated retention windows, including per-customer retention settings, are not yet enforced.

Security

• All data in transit is encrypted via TLS 1.3
• All data at rest is encrypted using AES-256 (Google Cloud SQL managed encryption)
• API keys are stored as salted hashes (bcrypt)
• Passwords use bcrypt with default cost factor
• OAuth refresh tokens are stored as SHA-256 hashes
• Hardware TEE isolation (AMD SEV-SNP on GKE Confidential Nodes) is available under Enterprise engagements that require it; standard Enterprise processing runs on Google Cloud Run without TEE isolation
• Access controls enforce role-based permissions (admin, engineering_admin, security_auditor, compliance_reviewer)

MCP Server Privacy

The Shrike MCP server (shrike-mcp) is an open-source thin client that connects to the Shrike backend for scan processing. Specific privacy considerations for MCP usage:

• The MCP server only sends data you explicitly pass to its tools (scan_prompt, scan_sql_query, etc.)
• It does not collect extraneous conversation data or log conversations
• Session IDs are ephemeral — generated per MCP process, not persisted across restarts. When accumulated session risk crosses the rotation threshold, the client auto-rotates its session ID and reports the previous/new pair to the caller
• Client-side PII redaction runs before data leaves your machine (when enabled)
• The reset_session tool clears server-side session state for sessions below the block-risk threshold (0.8). Sessions that have accumulated block-risk require administrator invalidation — a self-service reset from a compromised session is not permitted
• Response sanitization strips internal detection details before returning results

Third-Party Services

Shrike uses the following third-party services to operate the platform:

• Google Cloud Platform — Infrastructure hosting (Cloud Run, Cloud SQL, Vertex AI)
• Google Vertex AI — LLM analysis layer (Layer 7). Scan content is sent for semantic analysis. Google's data processing terms apply.
• Google Workspace (Gmail SMTP) — Transactional email (signup, alerts). We send only to your registered email address.
• Google/GitHub OAuth — Optional authentication providers. We receive your email and profile name only.
• Stripe — Payment processing for Pro and Team subscriptions. Billing email and payment metadata only; no scan content.
• GCP Marketplace / Cloud Commerce — Enterprise marketplace billing. Procurement account ID only.
• Microsoft Clarity — Usage analytics on the public marketing site only (homepage, blog, docs, learn, pricing, playground). Clarity loads only after you accept analytics cookies in the consent banner, and sets the _clck and _clsk cookies (plus Microsoft's MUID) when active. Declining, or a browser Global Privacy Control signal, keeps it off entirely; you can change your choice any time via "Cookie settings" in the footer. When active it records page interactions with form inputs masked. It is never loaded on the authenticated platform: capture stops the moment a session enters the dashboard, so scan results, policies, and customer data are never recorded. Microsoft's privacy statement applies.

We do not share your data with any other third-party services. Inside the authenticated platform, no advertising networks, analytics trackers, or data brokers receive your information.

Your Rights

You have the right to:

• Access — Request a copy of all data we hold about you
• Deletion — Request deletion of your account and all associated data
• Export — Export your scan history, incidents, and configuration
• Correction — Update inaccurate account information
• Restrict processing — Switch to observe-only mode (no enforcement actions)
• Withdraw consent — Disable optional features like scan logging at any time

To exercise any of these rights, contact us at privacy@shrikesecurity.com. We will respond within 30 days.

Compliance

Shrike's data handling practices are designed to support compliance with GDPR, CCPA, HIPAA, SOC 2, and ISO 27001 requirements. See our Trust Center for detailed compliance mappings.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and posted on this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

Contact