Skip to main content
You own your code and everything Iron Octopus builds for you. Iron Octopus uses your content only to do the work you ask for, never to train AI, and protects it in transit and at rest. This page summarizes how. The Privacy Policy and Terms of Service are the full, binding versions. If anything here differs from them, they apply.

​
Your code and content

  • You own it. Your ideas, requirements, conversations and data, and the code, tests, plans and other work Iron Octopus produces for you, belong to you.
  • It’s used only to provide the service to you. Iron Octopus doesn’t read your content to improve the product unless you ask it to help with a specific problem.
  • You can take it with you. You can export your code at any time. See where your code lives.

​
AI and your content

  • No training. Your content isn’t used to train or fine-tune any AI model. Iron Octopus uses AI providers under terms that don’t let them train on it either.
  • Only what’s needed. Iron Octopus sends the parts of your content a task needs to the AI provider, through the provider’s business API.
  • Limited retention by providers. Providers may keep requests briefly to detect abuse, as their business terms allow, then delete them.
  • Your own provider. If you connect your own AI subscription, content sent through it goes to that provider under your agreement with them.

​
Who your data is shared with

Only the service providers that run Iron Octopus, and only what each one needs: Each is bound by contract to protect your data and use it only to provide its service. The list is updated before a new provider that handles customer content is added. Iron Octopus doesn’t sell personal information or use it for advertising.

​
How it’s protected

  • Encryption. All data is encrypted in transit. Stored data is encrypted at rest, and credentials for connections such as GitHub and AI providers are encrypted separately.
  • Payment details. Card details go to Stripe. Iron Octopus never sees or stores your full card number.
  • Limited access. Access to production systems is limited to the people who need it.
  • Breaches. If a breach affects your personal information, you’ll be told without undue delay and as the law requires.

​
Access in your workspace

  • Roles. Every member is a Guest, Member, Admin or Owner, and each action checks the role. See roles.
  • Sign-in. Each person has their own account. Accounts can’t be shared. Workspace SSO (SAML or OIDC) is available through support.
  • A record of everything. Every plan, approval, review, release and rule change is recorded with who made it and when. Rule changes also record why. See feature history.
  • Rules can’t be bypassed silently. Changing a rule needs an Admin, a reason, and a published version. See change a rule.

​
How long it’s kept

​
Where it’s stored

Iron Octopus is hosted in the United States. For transfers from the EU, UK or Switzerland, Iron Octopus relies on the European Commission’s Standard Contractual Clauses, with the UK addendum, or another lawful transfer method. A data processing agreement is available on request.

​
Cookies

Iron Octopus uses only the cookies needed to sign you in, protect against fraud and take payment. There are no analytics, advertising or tracking cookies, so there’s no cookie banner.

​
Your rights and contacts

You can ask to see, correct, export or delete your personal information, or object to how it’s used. Requests are answered within 30 days. Iron Octopus Inc., 849 W 18th St, Ste C, Costa Mesa, CA 92627.
  • Privacy Policy: what personal information is collected, why, who it’s shared with, and your choices.
  • Terms of Service: the agreement for using Iron Octopus, including ownership, billing and acceptable use.