Designed to be truthful, fail-closed,
and auditable by default.

What happens to our data when the Pilot ends?

Your workspace stays readable and your evidence stays exportable for 30 days after the Pilot ends. After that, telemetry, detections, alerts, findings, incidents and evidence exports — including the stored export files — are permanently deleted, and audit logs are anonymized. The remaining anonymized audit record is deleted 365 days after the Pilot ended. Upgrading or continuing before the deletion runs cancels it. An active Pilot has no deletion schedule at all. Exact per-class periods are in the Privacy Policy.

Can we have our data deleted sooner?

Yes. A workspace owner or administrator can request immediate deletion from Settings → Security. It requires a recent re-authentication and a typed confirmation, is recorded in the audit log, and returns a deletion receipt — a hash of the report listing what was removed, containing none of the deleted content. A legal hold overrides it.

Is deleted data really gone, including backups?

Deleted data is removed from our active systems on the stated schedule and cannot be restored through any Decoda API. Residual encrypted copies may remain in our infrastructure providers’ backups until their normal backup-retention cycle completes, after which they are overwritten. We do not claim zero residual data, because we cannot prove it.

Can Decoda staff see our data?

Not your monitored data. Decoda personnel cannot read your telemetry, detections, alerts, incidents or evidence without ordinary membership of your workspace, and there is no impersonation or log-in-as mechanism — no Decoda tool can sign in as one of your users. Authorized Decoda personnel can see account-level information about your organization — plan, status, usage, workspace and member metadata, and the evaluation feedback you submitted — through an internal console. Customer-specific access there is recorded with the staff actor, the organization and workspace context, the operation and the timestamp, and those events appear in your own workspace audit history as “Decoda staff”, marked read-only or change. Cross-tenant listings — an internal directory spanning all customers — are recorded internally and are not shown in any one customer’s history.

Do you require multi-factor authentication?

Yes, for Pilot. Every human user of a Pilot workspace must have a second factor enrolled AND must have completed a challenge on the current session before any Pilot business or data API will answer them. It is enforced on the server for every role and every authenticated route, including direct API calls, newly invited accounts and sessions that existed before enrolment — not by hiding screens in the UI. Approving a response action or an execution requires a further, recent step-up challenge. MFA protects sign-in and session access; it does not make a stolen session token harmless, and we do not claim it does.

Does Decoda ever hold our wallet keys or move our funds?

No. Decoda does not request, ingest or store customer wallet private keys, seed phrases or customer signing credentials — there is no field anywhere in the product that accepts one, and values shaped like one are stripped or refused at ingestion. Pilot workspaces additionally cannot execute production blockchain state changes at all: they observe, investigate, simulate, recommend and evidence. Signing, broadcasting, pausing a contract, freezing a wallet and moving funds are refused by a server-side entitlement check, not by a hidden button.

What happens to the data we send you?

Decoda’s supported telemetry is public blockchain data. Credential-shaped values — private keys, seed phrases, API tokens, passwords — are stripped at ingestion before the record is stored or forwarded, and each workspace can add its own redaction rules. Two things we will not claim: the raw request does reach Decoda before the sanitizer runs, and rows written before a redaction rule existed are not retroactively rewritten. Public chain fields such as addresses, transaction hashes and amounts are kept deliberately — they are what the product monitors — so this is redaction of credentials, not anonymization of telemetry.

Is Decoda SOC 2 certified?

Not yet. We are an early-access production SaaS. SOC 2 Type II audit is on our roadmap. We will not claim certification until it is achieved.

Is this GDPR-compliant?

The platform is designed to process operational data (on-chain addresses, telemetry events, governance records), not personal data. We minimise data collection. See our Privacy Policy for detail.

How do I report a security issue?

Email security@decodasecurity.com with a description of the issue. We will acknowledge within 48 hours and coordinate disclosure. We do not have a formal bug bounty programme at this stage.

Where is data stored?

Production data is stored in a managed PostgreSQL database hosted in the EU (Neon). Evidence exports can be configured to land in your own S3-compatible bucket.