Privacy Policy

This policy covers everyone who interacts with Marshal: visitors to marshal.codes, people who ask us for access, administrators and end users of Marshal deployments, and anyone whose data reaches us through a service you connect to Marshal.

Marshal is built to keep your data in your own infrastructure. Most of what the product touches — your source code, your credentials, your agent sessions, your audit trail — never reaches us at all. Section 4 sets out exactly where that line falls.

1. Who we are

Marshal Security Ltd. (“Marshal”, “we”, “us”), a company registered in Israel, is the controller of the personal data described in this policy. For anything privacy-related, including access and deletion requests, email privacy@marshal.codes. We answer within 30 days.

Where you run Marshal inside your own infrastructure and we merely provide the software, you are the controller of the data your deployment processes and we are not a party to it.

2. The short version

3. What we collect, and why

3.1 Visiting this website

We use PostHog to understand how the site is used — which pages are viewed, in what order, and when people leave. Analytics profiles are identified only: unless you separately identify yourself to us, your activity is not linked to a named person. PostHog sets cookies in your browser to do this. Analytics data is processed in the United States.

Our servers also keep ordinary request logs — IP address, timestamp, requested path, user agent — which we use to keep the site up and to investigate abuse.

3.2 Asking us for access, or contacting us

Our access form asks for your email address and, optionally, your company, team size, role, and a message. Those fields are delivered to us as email and used to reply to you and to evaluate the request. We do not sell them, and we do not add you to unrelated marketing.

If you email support@marshal.codes or privacy@marshal.codes, we keep the correspondence so we can handle your request and any follow-up.

3.3 Marshal-hosted services

Some parts of Marshal run on our infrastructure. Each is narrow by design:

• Auth broker. When your organization uses our hosted broker for single sign-on, the broker receives your email address, whether your identity provider considers it verified, and the opaque account ID that provider assigns you. It confirms that identity to your Marshal deployment and steps out of the way. We do not keep a user database — your deployment holds your account, and once it has issued you a session, day-to-day use does not involve us. The broker keeps a short-lived record of sign-in events to defend against abuse, and stores your organization’s configuration (organization name, an administrative contact email, and any allowed email domains).
• Marketplace. When a deployment searches, browses, installs, or uninstalls a package, we record that event so we know which packages matter. Where a deployment is configured with a token, the event is attributed to that deployment; otherwise it is unattributed. These events describe packages and deployments, not individual people.
• Registry and distribution. Pulling images, charts, and CLI builds from our registries produces ordinary access logs — IP address, timestamp, artifact requested.

3.4 Services you connect to Marshal

Marshal connects to third-party services at your direction — chat platforms such as Slack, identity providers such as Google, code hosts such as GitHub, and others. When you authorize a connection, that service shares data with your Marshal deployment according to the permissions you grant, and your deployment holds the resulting access tokens. You can see the exact permissions on the consent screen before you approve, and you can revoke them at any time from that service or from Marshal.

Where such a connection runs through a Marshal-hosted component, we handle it as described in section 3.3 and keep no copy of the message, file, or repository content that passes through.

4. What stays in your infrastructure

Marshal is designed to be run inside your own network. In that deployment model the following never reaches us:

• Your source code, and anything an agent reads or writes.
• Agent session content — prompts, transcripts, tool calls, command output.
• Your credentials, secrets, and the tokens for services you have connected.
• Your audit and egress logs.
• Your user and organization records, and the sessions your deployment issues.

These live in your own database and object storage, under your own retention and access rules. We cannot read them, and we cannot produce them on request — including to a third party who asks us for them.

5. Data we receive but do not use

Some data reaches us as a by-product of a system working normally, and we want to be explicit about it rather than leave it unsaid:

• Identifiers contained in the payloads of connected services — for example the workspace, channel, or user IDs a chat platform includes when it invokes an integration. We use them only to route the request being handled and do not profile or analyze them.
• Incidental content in diagnostic logs and error reports. We do not mine it; it ages out on the schedule in section 6.
• Data that a service you connected makes available under a permission we hold but do not exercise. If we do not need it, we do not read it.

6. How long we keep it

We keep data longer only where the law requires it, or where it is needed to resolve a dispute or enforce an agreement. When a retention period ends, the data is deleted.

7. Who else touches your data

We do not sell personal data, and we do not share it for advertising. We use a small number of providers to run the service, each bound to handle data only on our instructions:

We may also disclose data where we are legally required to. If we are compelled to hand over data about you, we will tell you unless we are prohibited from doing so.

8. Your rights

You can ask us to:

• Access — tell you what personal data we hold about you.
• Export — send it to you in a portable, machine-readable form.
• Correct — fix anything inaccurate.
• Delete — erase it, subject only to data we must legally keep.
• Object or restrict — stop or limit a particular use, including analytics.

Email privacy@marshal.codes from the address the request concerns, or tell us how to verify you if you cannot. We respond within 30 days, free of charge. These rights apply to everyone who asks, whether or not the law in your country grants them — including the rights the GDPR and the CCPA provide, where those apply to you. Exercising them will never cost you access to the product, and you can complain to your local data protection authority if you are unhappy with our answer.

If your data sits inside a Marshal deployment run by your employer or another organization, send the request to them — they control that data, not us. We will help them action it.

9. International transfers

We operate from Israel and use providers located in the United States and Europe, so your data may be processed outside your own country.

Israel is recognized by the European Commission, and by the United Kingdom, as providing an adequate level of data protection — so personal data moving from the European Economic Area or the UK to us does so under that adequacy decision. Where a provider processes data in the United States, we rely on the European Commission’s standard contractual clauses.

10. Security

Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it, authenticated through single sign-on, and logged. Our hosted components are deliberately scoped so that a compromise of any one of them does not expose customer code, credentials, or agent activity — because we never hold them.

To report a vulnerability, email security@marshal.codes. If a breach affects your personal data, we will notify you and the relevant regulator without undue delay.

11. Children

Marshal is a tool for professional software teams. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe we have, email privacy@marshal.codes and we will delete it.

12. Changes to this policy

When we change this policy we update the date at the top of the page. If a change materially affects how we handle your data, we will tell affected users directly before it takes effect.

13. Contact

Privacy and data requests: privacy@marshal.codes
Terms of use: marshal.codes/terms
Everything else: marshal.codes/support