Armature procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Where personal data is transferred outside the EEA or the UK, we rely on Standard Contractual Clauses or equivalent safeguards.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Armature runs in two regions: an EU-based hosting region and a US-based hosting region. Customers choose where their workspace lives when they sign up. Data in an EU workspace is stored and processed in the EU.” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Where personal data is transferred outside the EEA or UK, we rely on Standard Contractual Clauses or equivalent safeguards.” | Captured 2026-07-19Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The Armature platform runs in two regions: an EU-based hosting region and a US-based hosting region. Customers choose where their workspace lives when they sign up. Data in an EU workspace is stored and processed in the EU.” | Captured 2026-09-24Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ The website, the scanner and the Agent Discoverability service run on our providers' infrastructure in the US and the EU.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Armature platform: account data is kept while your account is active. Session data is kept for the retention period of your plan: 7 days on the free plan and a custom period on custom plans. AI Traffic keeps raw events for 30 days by default. When you delete your account or ask us to delete data, we remove it from production promptly and from backups within 90 days.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Agent Discoverability service: the service holds no data from you. We keep the contact details of the people we work with as described below.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can stop using the service and delete your account at any time. We can suspend or terminate accounts that break these terms, with notice where practical. After termination we make your data available for export for 30 days, then delete it as described in the Privacy Policy . Sections that by nature survive termination, such as confidentiality and liability, survive.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Account data is kept while your account is active. Session data is kept for the retention period of your plan, 7 days on the free plan and a custom period on custom plans. When you delete your account or ask us to delete data, we remove it from production promptly and from backups within 90 days.” | Captured 2026-07-19Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Completed scan data and HTTP metadata are kept for at most 90 days. Raw scan artifacts expire after 7 days. Scan events expire after 24 hours. The public result cache expires after 24 hours. Access and security logs expire after 30 days. Encrypted backups expire within 90 days. To stop future scans or ask for deletion, email privacy@armature.tech . We verify control of the domain without asking for credentials.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Business contacts: we keep contact details while we work together, and after that as long as we need them for our records or as the law requires.” | Captured 2026-09-24Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We keep their contact details, such as their name, work email address, company and job title. We also keep our emails and messages, our notes from calls, and the contracts and invoices.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Customer.io Product and marketing email to registered users. Platform ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ A result page may request the public domain icon from Google's favicon service. The request uses a no-referrer policy.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Slack Delivers form messages to our team, and alerts to customer workspaces when the customer sets them up. Website, platform ” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We test coding agents from providers such as Anthropic, OpenAI, Cursor, Meta and xAI. Other AI models act as the user and score the results. All these models receive only our test tasks, our test repositories and public information. They receive nothing from you.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share data only with the providers we need to run our products. The last column shows which products use each provider.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We may also disclose information when the law requires it.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Exa is a web search provider. For Exa checks, we send the canonical public domain, a derived brand name, and fixed search text. We run two general searches and nine fixed directory searches. We do not send raw page bodies to Exa.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Traffic data: we measure traffic with Vercel Analytics, which stores no identifier on your device. We also record page views and clicks with PostHog, without a person profile. Section 14 explains both.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Usage data: we record how you use the Armature app with privacy-preserving product analytics. The app also loads the X pixel when you visit it or create an account.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ AI models used to classify and score sessions.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Billing data: Stripe processes payments. We receive the billing status and invoices, and we never store card numbers.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The service depends on third-party providers such as cloud infrastructure, AI model providers and payment processing. Their availability is outside our control, and their own terms apply to their services.” | Captured 2026-09-24Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Delivers alerts to customer workspaces when configured.” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We share data only with providers we need to run the service:” | Captured 2026-07-19Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Advertising measurement: we load the X advertising pixel and the LinkedIn Insight Tag so we can measure campaigns we run on X and LinkedIn. These tags may set cookies or similar identifiers and send visit data to X or LinkedIn. When you send us a contact form or a lead form, or book a call, we also report that a contact was completed. We report it without the content of your message or your email address.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ The free plan includes 1,000 credits per month: 1,000 sessions, 100 eval runs, or any mix. Beyond that, usage is billed at $50 per 1,000 extra credits. Custom plans and discoverability engagements are agreed separately. Payments are processed by Stripe, and usage charges are billed monthly in arrears.” | Captured 2026-09-24Open source →Finding permalink → |
| Tier differences | All applicable tiers | unknown | “ We may change prices with at least 30 days notice, effective at your next billing period. Fees exclude taxes, which you are responsible for where applicable.” | Captured 2026-09-24Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.