Skip to main content

Privacy policy

Last updated 16 October 2026

Questions about this policy: hello@vulkro.com. Also read the terms of service.

Who this covers​

Vulkro is a security product for application code and Salesforce, built and operated by Reveriext Inc. ("Reveriext", "we", "us"), a Delaware corporation in the United States. This policy describes what we collect when you visit vulkro.com, sign up, run the vulkro or vulkro-sf scanners, the VS Code extension or the MCP server, or use Vulkro Cloud and the customer portal at app.vulkro.com.

Whose data it is. The content of a Vulkro Cloud workspace belongs to the organization that owns it. That organization decides what is connected and who can see it, and we handle it on its behalf, to run the service. If you are a user in a Salesforce org or a repository someone else scans, questions are best put to that organization first. For your account, billing details and what this website collects, Reveriext Inc. is responsible.

Vulkro is for businesses and professionals. It is not directed to anyone under 18, and we do not knowingly collect personal information from children.

Vulkro never sells data​

Vulkro never sells data. Not your code, not your findings, not your workspace, not your account. We do not share it for advertising, and we do not use it to train a model. What reaches another company is limited to the providers listed under Sub-processors, which process it to run Vulkro, and to what the law requires of us, for example a valid court order.

What a scan on your machine sends​

Nothing about your code. The scanners scan on your own machine. A scan never sends us your source code, your findings, file or repository names, secrets it finds, your hostname or your username.

The scanners make only these calls, and VULKRO_OFFLINE=1 turns every one of them off:

  • Install and updates. The installer, the binary and the signed vulnerability bundle from dist.vulkro.com, and one anonymous install count (product, platform and version only; turn it off with VULKRO_NO_ANALYTICS=1).
  • Sign-in and licence. When you sign in: the product, a random installation ID, the version, and a one-way hash of the machine's hardware ID, which we use to allow one trial per machine. While signed in, the licence is refreshed with the device token only.
  • A usage heartbeat, at most every six hours: the product, version, installation ID, operating system, licence state and the number of scans, and when they apply the device token, the language names a scan found, the command names you ran (never their arguments or output) and your editor. Never a hostname, a path, a project name or a finding. Turn it off with VULKRO_NO_HEARTBEAT=1.

Features you turn on. Optional AI features use a local model by default; if you configure a hosted model with your own key, the finding and a short code excerpt go to that provider, never to us. Live vulnerability lookups (VULKRO_CVE_LIVE=1) send dependency names and versions to the public OSV database. Secret validation sends a found credential to the service that issued it. Notifications send a scan summary to the destination you name. The organisation dashboard (vulkro publish) uploads a posture snapshot of a repository you choose, with no source code; its terms are on Organisation dashboard data processing.

What we collect and why​

  • Your account. Your name and email address, your sign-in ID at Clerk (our sign-in provider), and what you choose to tell us when you set up your account. We use them to sign you in and to send email about your account.
  • Your machines and licences. The machines you sign in from (installation ID, the name you give it, the version, the hardware hash), your licences, trial and subscription status. We use them to run your licence and to allow one trial per person and per machine.
  • Billing details. The plan, the billing interval, the status and the renewal date, copied from Clerk Billing. Card details are typed into Stripe's own fields; they do not pass through our servers and we do not store them.
  • Offline licence files. If you generate one, it contains your email address, the plan, the expiry date and the machine ID you entered, signed with our key. We keep a record of each file issued so we can support it.
  • What you write to us. Email you send to support@, billing@, license@, security@ or hello@vulkro.com, kept so we can answer it.

Vulkro Cloud​

When your organization connects a Salesforce org or a repository to a Vulkro Cloud workspace:

  • From Salesforce it reads org settings and metadata, your Apex, Visualforce, Lightning and Flow code, and data about your Salesforce users and their activity (names, usernames, email addresses, profiles and roles, login history including IP address and country, the Setup Audit Trail and, where you have them, Event Monitoring logs). It does not read your business records (accounts, contacts, opportunities, cases, custom object records), and it never writes to your org.
  • From repositories each scan clones the branch into its own container and deletes the copy when the scan ends. It writes back to your git host only what you turn on.
  • Vulnerability lookups. While on (the default), dependency names, ecosystems and versions, including private package names, are checked against the public OSV database (api.osv.dev, operated by Google). Code is never sent. An admin can turn it off in Workspace Settings.
  • What it stores. The findings, the Salesforce user and activity data above, what the scanner derives from your code, code excerpts (unless you turn them off), and the issues, decisions and activity your team creates. Personal data is masked on screen and in exports by default.
  • Cloud scans on Pro. The scans and their results are deleted 14 days after they ran.

Vulkro Cloud does not send your data to any AI model. The full detail is on Vulkro Cloud data processing.

This website​

  • Analytics. vulkro.com is measured with Cloudflare Web Analytics: aggregate page views only. It sets no cookies and stores no identifier in your browser.
  • Cookies. This website sets no cookies. The portal and Vulkro Cloud use the cookies needed to keep you signed in, set by Clerk, and remember preferences such as light or dark mode. We use no advertising or cross-site tracking cookies.

Where it lives​

Vulkro runs on Cloudflare. Each Vulkro Cloud workspace has its own database and its own storage; no other customer's records sit in them. Account, licence and billing details are held in our own database, apart from workspace content. The location of the data is not pinned to a country, and sign-in data is held by Clerk in the United States.

Reveriext Inc. and the providers below operate in the United States and other countries, so your information can be processed outside the country you are in. If your organization needs contractual terms for this, write to us before you connect anything.

Who can see it​

Inside a workspace, access follows its member roles. Reveriext personnel can access a workspace only while a member has granted support access, to investigate a problem you reported, or to keep the service reliable and secure; never to read your data as a matter of course.

Security. Data is encrypted in transit, and at rest by our infrastructure provider. Access to production systems is limited to the people who need it. No system is perfectly secure. If we learn of a breach that affects your data, we tell you without undue delay, with what we know and what we are doing about it. To report a security problem, see the security policy.

Sub-processors​

We rely on a small number of providers to run Vulkro:

  • Cloudflare for hosting, the website, downloads, the portal, Vulkro Cloud and licence issuance.
  • Clerk for sign-in, and subscriptions and billing (Clerk Billing).
  • Stripe for card payments, through Clerk Billing.
  • Resend for the email Vulkro sends.
  • Our email provider for the mailboxes behind our @vulkro.com addresses. It holds what you email us.

Services you choose to connect (Salesforce, your git host, Slack, Microsoft Teams, Jira, your AI provider) are your own tools, under their own terms, not our sub-processors. When we add a provider that handles your data, we update this list. If your organization needs a data processing agreement, write to us.

How long we keep it​

  • Your account is kept while it exists. When it is deleted, the records we must keep for tax, for one trial per machine and as proof of consent stay, with your name, email address and IP address removed.
  • Vulkro Cloud data is kept as your workspace configures it, within your plan. A plan change never deletes data. Deleting an org or a repository deletes its results. When a plan ends the workspace stays read-only until it is deleted.
  • Cloud scans on Pro are deleted 14 days after they ran.
  • Billing records are kept as tax and accounting law requires.

Export and deletion​

You do both yourself:

  • Export. A workspace admin can export everything from Vulkro Cloud at any time, including while it is read-only.
  • Delete. You can delete your own account at app.vulkro.com, under Settings, Profile. A workspace owner can delete the workspace. Deleting your portal account does not remove you from a Vulkro Cloud workspace: its admins do that.

For anything these do not cover, write to us (below).

Your rights​

Depending on where you live, the law may give you the right to ask what personal information we hold about you, to get a copy of it, to have it corrected or deleted, and to object to or limit how it is used. Write to us (below) and we will answer within 30 days. We may need to confirm who you are first. We do not treat anyone differently for making a request.

If your request is about data in a workspace that belongs to someone else, for example your employer, we pass it to that workspace's owner, who decides what is kept there. If you are not satisfied with our answer, you may also have the right to complain to the data protection authority where you live.

Changes to this policy​

We'll update the date at the top of this page when this policy changes, and post the new version here. We won't narrow your rights under an earlier version without telling you first.

Contact​

Vulkro is operated by Reveriext Inc. For a question about this policy, or to ask for access to, correction of, or deletion of your data, write to hello@vulkro.com. About an account or a workspace you already have, write to support@vulkro.com.