Last updated: 4 October 2026 · Effective: 4 October 2026
1. Who we are
Araghatta LLC, a New Jersey limited liability company (“Araghatta”, “we”, “us”), provides the Sargha AI security platform and security-testing services. For platform data processed on behalf of a customer, the customer is the data controller and we act as processor under the Data Processing Addendum. For our website and enquiries, we are the controller.
2. Data we collect
- Enquiry data: name, work email, organization, and the details you submit through our contact form or when booking a call.
- Platform telemetry (as processor): AI-usage metadata from your endpoints: process/binary names, API-key presence and provider (never values), MCP configurations, installed AI tools, and egress destinations, attributed to machine and user. We do not collect file contents, secret values or keystrokes, and we do not store prompt or response bodies. If you turn on the optional in-browser DLP extension, it checks the text a person submits in memory and does not store it; only the decision, the destination site and the kinds of data found are recorded.
- Account & usage: authentication data (hashed credentials, MFA secrets), audit logs of actions taken in the console.
- Website: minimal server logs; we do not use advertising trackers. Essential cookies only. If you use the website assistant, the messages you type are sent to our AI provider (OpenAI, United States) to produce a reply, so please do not enter sensitive information.
- Workforce (monitored endpoints): for platform customers, the sensor collects AI-usage metadata only and never reads file contents, prompts, keystrokes or screenshots. The optional in-browser DLP extension checks submitted text in memory and does not store it. See how we handle the privacy of monitored employees, including our DPIA-friendly data map and works-council support.
3. Why we process it & legal basis
To respond to enquiries and provide the service (contract / legitimate interests), to secure and improve the product (legitimate interests), and to meet legal obligations. Platform telemetry is processed only on documented instructions from the customer-controller.
4. Retention
Enquiry data: up to 24 months from last contact. Platform data: per the customer’s configured retention, deleted on request or at contract end. Audit logs are retained for the period required for security and compliance.
5. Sharing & subprocessors
We do not sell personal data. We share it only with the subprocessors listed on our Sub-processors page (summarized in the Trust Center) and in the DPA, and where legally required. In-VPC deployments have no external data subprocessors. We notify customers of new subprocessors before they begin processing customer data.
| Entity | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting, storage and secrets (KMS) for managed deployments | Hosted in the United States. United States only: AWS us-east-1 (N. Virginia). Managed tenants are not offered in an EU region today. Customer-cloud (in-VPC) deployments run in the region you choose |
| Google Workspace (SMTP relay) | Transactional email (enquiries, alerts) | United States |
| Reasoning backend (configurable): OpenAI (default) | AI triage and explanation of findings: a managed hosted model (OpenAI, United States by default), or Amazon Bedrock inside your account (in-VPC), or fully local inference; deterministic-only sends nothing to a reasoning model | United States by default; inside your account for in-VPC; none for local or deterministic-only. Provider region: United States |
6. International transfers
Managed tenants are hosted in the United States, so data from customers elsewhere is transferred there. Where transfers occur, we rely on appropriate safeguards (e.g. Standard Contractual Clauses).
7. Your rights
Subject to applicable law (GDPR/UK GDPR/CCPA), you may request access, correction, deletion, restriction, portability, or object to processing, and (CCPA) opt out of “sale”, which we do not do. Contact info@araghatta.com. For platform data, we forward requests to the relevant customer-controller.
8. Security
We apply the controls described in our Trust Center: encryption in transit and at rest, RBAC, MFA, least-privilege access and audit logging.
9. Changes & contact
We will post material changes here with an updated date. Questions: info@araghatta.com.
See the AI on your fleet in about a week.
Run the sensor across your estate and receive an AI risk report and an AI Bill of Materials. The assessment is free and carries no commitment.