Verdent ("we" or "us") serves as your AI coding assistant. We recognize that protecting your source code and development environment is critically important. Accordingly, we shall use our best efforts to ensure the security and confidentiality of your data and shall provide you with our security assurance measures to facilitate your risk assessment.

All of our infrastructure and your data are located exclusively within the United States (U.S.). To learn more about how we collect, use, store and process your data, please refer to VERDENT'S PRIVACY POLICY.

If you identify a potential vulnerability or have any security-related concerns in connection with the website, programs, tools and other services we provide —— including but not limited to the Verdent desktop app and the Verdent for VSCode extension (collectively, the "Services"), please contact us at hi@verdent.ai.

To ensure the security, availability, integrity, confidentiality, and privacy of your data while using our Services, we are actively pursuing SOC 2 and ISO/IEC 42001 certifications. We will update this Policy with the relevant details once these certifications have been obtained.

Verdent's infrastructure is fully hosted on AWS, with all servers deployed in the U.S. We rely on the following sub-processors to support our Services.

• AWS (Sees and stores code data): Our entire infrastructure is hosted on AWS, with all computing and storage operations conducted in the U.S.
• Azure AI Foundry (Sees code data): We rely on Azure AI Foundry to provide large language model services. Certain secondary infrastructure is hosted on Microsoft Azure AI Foundry, with all Azure servers located in the US.
• Google Cloud Vertex API (Sees code data): We rely on the Vertex API to access Gemini models for AI responses. We have a zero data retention agreement with Google Cloud Vertex API.
• AWS Bedrock (Sees code data): We rely on AWS Bedrock to provide large language model services. We have a zero data retention agreement with AWS Bedrock.
• Parallel.ai (Sees search requests, potentially derived from code data): We use Parallel.ai for web search functionality. When Verdent invokes the websearch tool, the query is transmitted to Parallel, which returns relevant URLs.
• Jina (Sees search requests, potentially derived from code data): We use Jina for web content retrieval and parsing of search result pages. When Verdent invokes the webfetch tool, the URLs are transmitted to Jina, which returns the corresponding website content.
• Stripe (Sees no code data): We use Stripe for billing. Stripe stores personal data such as name, credit card information, and billing address.

Verdent respects model blocklists and will not send requests to models on the blocklist.

Access to infrastructure is granted on a least-privilege basis. Multi-factor authentication is required for AWS access.

Certain Verdent Services incorporate the Visual Studio Code (VS Code) extension. Since the extension runs directly within the official VS Code IDE maintained by Microsoft, all general updates and upstream security patches from the microsoft/vscode codebase are automatically inherited as part of your VS Code installation. For any high-severity security patch released in the upstream VS Code, you only need to update VS Code itself to receive the fix, and Verdent will continue to work seamlessly on top of it. You can refer to the Visual Studio Code GitHub security page for relevant security advisories.

Our Services make requests to the following domains to communicate with our backend. If you are behind a corporate proxy, please whitelist these domains to ensure Verdent works correctly. This list may not be exhaustive; we recommend whitelisting all domains under .verdent.ai to ensure proper operation of our Services.

• api.verdent.ai: Used for most API requests from the official website.
• agent.verdent.ai: Used for most API requests from the Verdent VS Code extension.
• llm-proxy.verdent.ai: Used for most requests from Verdent Deck.
• log.verdent.ai: Used for event logging.
• login.verdent.ai: Used for user authentication and account registration.

To safeguard the security and privacy of your data, the Services currently do not offer indexing or analysis of your code repositories.

To provide its functionality, Verdent sends AI requests to our servers for various purposes. Each AI request typically contains contextual information, such as your conversation history, along with the execution results of tools invoked by the agent. This data is initially sent to our infrastructure on AWS and then routed to the appropriate language model inference provider (Azure, AWS, or GCP).

You can delete your account at any time by contacting us at hi@verdent.ai. Once your account is deleted, all account-related data will be removed. Data deletion is immediate, but please note that cloud backup systems may retain data until their normal retention periods expire, at which point the data is permanently erased.

If any of your data was used in model training (only possible if Privacy Mode was disabled), such models will not be retrained to remove it. However, no future training will include deleted data, as it is fully removed from our systems.

If you believe you have discovered a security vulnerability in Verdent, please report it to hi@verdent.ai.

We commit to acknowledging valid vulnerability reports within five business days and addressing them as promptly as possible. For critical incidents, we will notify all affected users via email.