Privacy Policy
This page explains what Vanguard Ops, Inc. (“VanguardOps”, “we”) collects, how it’s stored, and what your rights are. We aim for clarity, not legalese.
Last updated: November 13, 2026.
What we collect
When you create an account: your email, an optional name, and a hashed password. If you arrived from a link with campaign tags, we also store those tags and the page you landed on, so we know which channels bring people in. This is stored in our database and used to give you access to VanguardOps and to contact you about your account.
When you connect a Salesforce org: an OAuth refresh token for the api and refresh_token scopes. The token is encrypted at rest using Fernet symmetric encryption, with the key held outside the database. We never see your Salesforce password.
When you run a scan: Salesforce metadata only — object schemas, field definitions, permission sets, automation logic, integration configuration. We don’t collect customer records, contacts, opportunities, files or emails from your org. Metadata can include the names of the Salesforce users who created or last changed a component. See our Security page for the architectural enforcement of this.
When you use the product: standard application logs (IP address, browser, timestamps, actions taken). We use these for debugging, abuse prevention, and security monitoring.
What we never collect
- Salesforce passwords (OAuth handles authentication; we never see them)
- Customer data of any kind from your Salesforce org
- Records, files, attachments, emails, or any object-level data
- Payment card or bank details. When you pay, they go straight to our payment processor, Stripe, and never touch our servers.
How we use what we collect
- To provide you access to the VanguardOps product
- To process scans and generate findings + remediation plans
- To respond to your questions and provide support
- To improve the product based on aggregated usage patterns
We do not sell, rent, or trade your information with third parties.
Subprocessors
VanguardOps relies on a small set of trusted infrastructure partners:
- Railway — Application hosting, database, and infrastructure
- Anthropic — AI processing for scan analysis, remediation plans and the AI Architect chat. We send Anthropic your org’s metadata (with email addresses redacted) and the questions you ask, never customer records. Anthropic does not train on our API customer data.
- Vercel — Website hosting and aggregate page-visit analytics
- Resend — Sends account and scan notification emails
- Google Tag Manager and Google Analytics — Website visit analytics. These set cookies on our website.
- Supabase — Stores website form submissions and lead records for our internal CRM
- Calendly — Books calls you schedule with us
- Stripe — Takes payments and sends invoices. Stripe holds your billing name, email and payment details; we only see what you paid and when
- Google Workspace — Internal company email and document storage
- Salesforce — Source of metadata via OAuth API access; never the destination of any of your data
Each subprocessor handles a specific function and only the data necessary for that function.
Data retention
- Account information: kept until you ask us to delete your account.
- OAuth tokens: stored encrypted until you disconnect the org, use Delete data, or delete your account. Revoking access at Salesforce makes them useless straight away.
- Scan results: retained while your account is active for historical comparison, or until you use Delete data for that org.
- Application logs: kept under our hosting provider’s log retention settings.
- Billing records (invoices and payments): kept for seven years, because tax law requires it.
- Audit logs of remediation actions: retained while your account is active.
Your rights
You can:
- Export your scan history at any time (request via chris@vanguardops.ai)
- Delete everything VanguardOps holds about a connected org yourself: in the app, go to Settings, pick the org and choose Delete data. The Security page lists what is removed and the three things that are kept.
- Delete your account (request via chris@vanguardops.ai)
- Revoke VanguardOps access to your Salesforce org via Salesforce Setup → Connected Apps OAuth Usage
International users
VanguardOps infrastructure is hosted in the United States (Railway US East region). If you access VanguardOps from outside the U.S., your information will be processed and stored in the U.S.
For users in jurisdictions with specific data protection laws (GDPR, CCPA, etc.), we honor data subject rights including access, correction, deletion, and portability. Email chris@vanguardops.ai with requests.
Changes to this policy
We will update this page when the policy changes. Material changes will be communicated by email and posted at the top of this page.
Questions
Email chris@vanguardops.ai.
Last updated: November 13, 2026.