01
Who we are
Trojan is operated by Chizulu Zephaniah, an individual based in Nova Scotia, Canada (“Trojan”, “we”, “us”, or “our”). We offer a local-first security scanning CLI and an associated web platform at trojancli.com.
For privacy questions, contact us at hi@trojancli.com.
02
What we collect
We keep data collection deliberately small. Depending on how you use Trojan, we may hold:
- Account data. If you create an account: your email address, name (optional), and billing details handled by our payment processor. We never store full card numbers.
- Findings metadata (Pro only). To sync history across your team, we store the shape of each finding — its rule ID, severity, file path and line, and status. We do not store the code around it.
- Usage analytics. Anonymous, aggregate counts — scans run, features used, errors hit — so we can fix bugs and prioritize work. No code, no file names, no identifiers you didn't give us.
- Cookies. Strictly necessary session cookies to maintain your login. No advertising or cross-site tracking cookies.
03
What we never collect
Your source code, file contents, environment variables, and git history stay on your machine. The scanner reads them locally to produce findings and then discards them. There is no code upload, on any plan, ever.
04
Local-first scanning
Every scan — secrets, dependencies and code analysis — runs as a process on your own hardware or inside your own CI runner. Rule sets are downloaded to your machine and matched locally. Because the analysis never leaves your device, Trojan works fully offline and in air-gapped environments, and we are physically unable to read your code.
05
Telemetry & opt-out
Anonymous usage analytics are on by default and help us keep Trojan fast and reliable. You can turn them off at any time:
$ trojan config set telemetry off06
AI-powered explanations
When you use the AI explanation feature (the “Explain” button in the report), a summary of the security finding — the affected file path, the scanner rule, and a short code snippet — is sent to a third-party AI provider to generate a human-readable explanation. This data is never used to train AI models.
This feature is only activated by your explicit action and never triggered automatically during a scan. Our current AI provider is Anthropic. Finding metadata sent is subject to their privacy policy. If you are uncomfortable with data being processed externally, do not use the AI explanation feature.
07
Account & team data (Pro)
Pro accounts sync findings metadata and settings so a team shares one view of what needs fixing. This data is encrypted in transit and at rest, scoped to your organization, and visible only to members you invite. Removing a member revokes their access immediately.
08
Third parties
We use a small number of vendors to operate — Stripe (payment processing), a cloud host, an email provider, and an error-monitoring service — each bound by a data-processing agreement and given only what they need. We do not sell or rent your data, and we do not share it for advertising.
09
Data retention
We keep account and findings data while your account is active. Cancel and it drops to Free; delete your account and we erase associated data within 30 days, except records we're legally required to keep (such as invoices — typically up to 7 years under Canadian law). Anonymous analytics are retained in aggregate only.
10
Your rights
Wherever you are, you can access, correct, export or delete your data — from account settings or by emailing us. We honour GDPR and CCPA requests, including the right to object to processing, and we honour PIPEDA for Canadian residents. We'll never make you jump through hoops to leave.
11
Security
We use industry-standard measures: HTTPS for all data in transit, hashed passwords (never stored in plaintext), and restricted access to production systems. Auth tokens stored by the CLI are written with owner-only file permissions (0600).
12
Contact
Questions, requests, or a security concern? Reach the team at hi@trojancli.com. Security researchers can disclose responsibly at security@trojancli.com — we read every report.