> For the complete documentation index, see [llms.txt](https://docs.nullify.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.nullify.ai/more-info/data-handling-policy.md). # Data Handling Policy Nullify processes the minimum customer data needed to detect, triage, and remediate security findings. This includes source code and metadata from connected repositories, dependency and container inventories, cloud configuration retrieved through least-privilege roles, and the organizational context you provide during onboarding. Data is encrypted in transit and at rest, scoped to your tenant, and access is restricted to the systems and personnel required to operate the platform. Findings, remediation history, and supporting context are retained for the lifetime of your tenant and removed in line with the retention schedules and deletion processes described in our legal documentation. Nullify does not sell customer data or use it to train models for other customers. ## Data subject rights Nullify supports data-subject access and erasure requests. An authorized administrator can use the [Admin API](/api-reference/api-reference/api-admin.md#data-subject-requests) to request a user export or erasure. Inspect the returned sections and erasure report: these operations have defined scope and are not a guarantee that every legal obligation or retention exception is resolved. The dashboard may direct you to support rather than expose these API operations. Contact support to coordinate a complete request. Please see our [legal documentation here](https://www.nullify.ai/legal). For GDPR compliance inquiries, including Records of Processing Activities, data retention schedules, breach notification procedures, and data subject rights, contact .