Privacy Policy

This page explains what VanguardOps collects, how it’s stored, and what your rights are. We aim for clarity, not legalese.

Last updated: May 27, 2026.

What we collect

When you create an account: your name, email, company name, Salesforce role, and the pain point you described on the beta signup form. This information is stored in our database and used to provide you access to VanguardOps and to communicate with you about the product.

When you connect a Salesforce org: an OAuth refresh token scoped to metadata APIs only. The token is encrypted at rest using Fernet symmetric encryption. We never see your Salesforce password.

When you run a scan: Salesforce metadata only — object schemas, field definitions, permission sets, automation logic, integration configuration. We never collect or store customer records, contacts, opportunities, files, emails, or any record-level data from your Salesforce org. See our Security page for the architectural enforcement of this.

When you use the product: standard application logs (IP address, browser, timestamps, actions taken). We use these for debugging, abuse prevention, and security monitoring.

What we never collect

Salesforce passwords (OAuth handles authentication; we never see them)
Customer data of any kind from your Salesforce org
Records, files, attachments, emails, or any object-level data
Payment information (during beta — no payment processing currently active)

How we use what we collect

To provide you access to the VanguardOps product
To process scans and generate findings + remediation plans
To respond to your questions and provide support
To send occasional product updates (you can opt out)
To improve the product based on aggregated usage patterns

We do not sell, rent, or trade your information with third parties.

Subprocessors

VanguardOps relies on a small set of trusted infrastructure partners:

Railway — Application hosting, database, and infrastructure
Anthropic — AI processing for remediation plan generation. We send Anthropic only metadata findings, never customer data. Anthropic does not train on our API customer data.
HubSpot — Beta signup form and lead communication
Google Workspace — Internal company email and document storage
Salesforce — Source of metadata via OAuth API access; never the destination of any of your data

Each subprocessor handles a specific function and only the data necessary for that function.

Data retention

Account information: retained for as long as your account is active. On deletion: removed within 30 days.
OAuth tokens: retained until you revoke access via Salesforce or delete your account.
Scan results: retained while your account is active for historical comparison.
Application logs: retained for 30 days.
Audit logs of remediation actions: retained while your account is active.

Your rights

You can:

Export your scan history at any time (request via chris@vanguardops.ai)
Delete your account and all associated data (request via chris@vanguardops.ai)
Revoke VanguardOps access to your Salesforce org via Salesforce Setup → Connected Apps OAuth Usage
Opt out of product update emails via the unsubscribe link on any email

International users

VanguardOps infrastructure is hosted in the United States (Railway US East region). If you access VanguardOps from outside the U.S., your information will be processed and stored in the U.S.

For users in jurisdictions with specific data protection laws (GDPR, CCPA, etc.), we honor data subject rights including access, correction, deletion, and portability. Email chris@vanguardops.ai with requests.

Changes to this policy

We will update this page when the policy changes. Material changes will be communicated by email and posted at the top of this page.

Questions

Email chris@vanguardops.ai.

Last updated: May 27, 2026.