Privacy

For the initial assessment, DETERMA may collect scoped metadata such as repository names, pull request metadata, review and approval metadata, CI and status metadata, workflow descriptions, and AI usage summaries where available. For External Action Control evaluations, scoped metadata may additionally include external workflow descriptions, target-system and target-object identifiers, record identifiers, approval metadata, state and version metadata, and evidence fingerprints.

DETERMA does not require production credentials, write access, secrets, production blocking, source code, transcripts, payment details, or clinical data by default for the first assessment. External Action Control evaluations remain metadata-first: no live external-system writes and no production execution authority are requested by default.

Data is used only to perform the agreed assessment, generate findings, produce the Governed AI Developer Score, and recommend whether GFDE Shadow Mode is appropriate.

Access is limited to the assessment team. Retention is governed by the agreed assessment scope and customer instructions.

DETERMA starts with a metadata-first approach to reduce operational and security risk during evaluation.

For privacy or data handling questions, contact privacy@determa.ai.