Fulcrum Audit privacy policy
Last updated: September 8, 2026
Fulcrum operates Fulcrum Audit at audit.fulcrum.rocks. This policy explains how we handle information when you sign in, connect services, submit source code or use an audit. For privacy questions or requests, contact tech@fulcrum.rocks using the link below.
Account and sign-in information
Clerk provides account authentication. We process your account identifier, email address, profile information and session information to identify you and control access to your audits. Google and GitHub sign-in request basic identity information, including your email and profile. Signing in does not connect your repositories or Google Analytics properties to an audit. Those connections require separate authorization.
Information you provide for an audit
We process your setup answers, selected repository or uploaded source archive, connected-service identifiers and selected provider evidence. An audit can produce source snapshots, findings, reports, exports, screenshots and execution records. Optional visual testing visits the app URL you provide and may use test credentials you supply. These visits may appear in your application logs. Only submit code, accounts and other information you are authorized to share for this purpose.
Connected services and permissions
Composio manages optional connections such as GitHub and Google Analytics. We use these connections to discover selectable resources and obtain evidence for the audit. Fulcrum limits provider operations to reviewed reads. Provider authorization can be broader: GitHub OAuth repository access includes write permissions even though our audit operations do not use them. Selecting a repository does not narrow the underlying OAuth grant. Review each provider’s consent screen and revoke access in that provider or disconnect it from Fulcrum when it is no longer needed.
How information is used and processed
We use information to authenticate users, acquire selected evidence, run audits, generate and deliver reports, diagnose failures, protect the service and respond to support requests. Cloudflare provides hosting, storage and execution infrastructure; Clerk handles authentication; Composio handles provider connections. Source and selected evidence are sent to external AI services, including models accessed through OpenRouter, for analysis. These services may process information outside your country under their own terms and policies. The current AI setup does not enforce a provider-wide zero-retention or no-training policy, so we cannot promise those protections.
Storage, logs and deletion
Source snapshots and audit artifacts are retained to run and support the audit; they are not automatically discarded when the report appears. Technical records, including request, error and execution information, help operate and troubleshoot the service. Where audit deletion is available, the interface displays its progress or any failure. Contact us to request deletion if you cannot access that action. Deletion of Fulcrum’s audit data is complete only when that workflow verifies it. Disconnecting a provider alone does not delete an existing audit. Data already processed by external providers is subject to their retention and deletion practices. Contact us for account deletion or other privacy requests.
Cookies and your choices
Authentication uses cookies and browser storage to maintain and protect sessions. Blocking them can prevent sign-in. You can choose which optional services to connect, use a ZIP archive instead of a GitHub connection, and skip optional visual testing. Depending on applicable law, you may have rights to access, correct or delete personal information or object to certain processing. Contact us to make a request; we may need to verify your identity. We update this page when our practices change and show the revision date above.