Privacy change record
We checked the fifty-five claims on the previous version of the privacy policy against the running code on 12 September 2026. Twenty did not survive. Twelve were false. Eight claimed more than the code supports.
Each old sentence is quoted as it stood. Where a quotation begins mid-sentence the capital is the one the old page used.
| What it said | What it says now |
|---|---|
| "Name — Your full name" | NowNo form here has a name field. 1.1 |
| Your key authenticates "that request's relay and the safety-classification request" | NowYour key relays your traffic and nothing else. 1.1, 3.1 |
| "using the provider API credentials your systems supply … to make the safety-classification requests" | NowThe relay on your credential, the check on ours. 2 |
| The classification request is sent "using the API credentials configured for your tenant" | NowUnder an Intercis-owned credential, covered by our agreement with that provider. 3.1 |
| "traffic routed to Anthropic is classified … under your Anthropic credentials" | NowThe provider and the model were right. The account is ours. 3.1, 6.2 |
| "traffic routed to OpenAI is classified … under your OpenAI credentials" | NowSame correction. That code has no fallback to a client key at all. 3.1, 6.2 |
| "We do not yet operate automated deletion schedules" | NowWe operate one, nightly, on the stored tool input. 5.2 |
| "Audit trails are retained for 90 days by default" | NowNothing deletes the row. Only the tool input goes at 90 days. 5.1, 5.2 |
| "We use a small number of providers to operate the service", listing six | NowResend and hCaptcha were missing. The service providers are eight. 6.1 |
| "Anthropic … in each case under the API credentials configured for your tenant" | NowThe relay under yours, the check under a credential Intercis owns. 6.2 |
| "OpenAI … in each case under the API credentials configured for your tenant" | NowThe same split, for OpenAI. 6.2 |
| "audit trails of policy enforcement are retained as described in Section 5" | NowIt inherited the retention error above. 5 |
| "Message — Any inquiry or message you submit" | NowNo form here has a free-text box. 1.1 |
| "Magic-link sign-in uses your email address only" | NowTrue of that path. There is a password path too. 1.1 |
| "the dashboard sets only the authentication cookies needed for sign-in" | NowIts signup page can also load hCaptcha, which sets its own. 1.3 |
| "execution-class tool calls … may additionally be analyzed" | NowFile writes, any mcp__ tool and any unreadable tool name are gated too. 3.2 |
| "Tool call content is never sent to a provider other than the one you have configured" | NowRight by provider, wrong by account. 3.1 |
| Relayed traffic "is governed by your own agreement with that provider" | NowTrue of the relay, silent on the check. 3.4 |
| "Infrastructure logs: Server logs generated by our hosting providers (Vercel, Railway)" | NowThe proxy writes its own access log, with the caller's IP and tenant. 1.2 |
| "it relays your agents' traffic … and applies your policy rules to it" | NowTo the tool calls your runtime would execute. Hosted tools never reach us. 3.3, 7 |
| "This page loads no JavaScript, no analytics, no third-party script" (13 September 2026) | NowEvery page loads one first-party Vercel Web Analytics script, cookieless; what it records is stated. 1.2 |