Security and data handling

Where your text is processed

• You run the AI Node yourself (any plan). Your text is masked on your own server and stays in your own network.
• We host the AI Node for you (Pro and up). It runs on our node server on DigitalOcean, with its own container, storage, network and keys for each customer. The AI Node does not send your text to any AI provider to mask it.
• The free scanner and the Live Playground. They run in your browser. What you paste never leaves your browser and is never sent to us.

What the AI Node masks

Email addresses, phone numbers, card numbers, US Social Security numbers, private keys, Vrymdor access tokens, and API keys and tokens for OpenAI, Anthropic, Stripe, GitHub, AWS, Google and Slack, plus bearer tokens and JWTs. A masked value reads like [REDACTED:EMAIL], or [REDACTED:EMAIL_1] when Restore (the Rehydrate setting) is on. Secrets are never put back. It does not mask names or street addresses by default; on Pro and up you can add your own patterns.

What is recorded

Every run gets an audit record. A record never holds your prompt or payload text. It holds which agent ran, the route and tool, the decision, the rules that applied, how many items were masked, the time taken, and a SHA-256 fingerprint of the bytes that were sent on, so a decision can be proven without keeping the text. Records are chained by hash, so a changed record is detectable.

How long records are kept

Audit records are kept for 30 days by default and then deleted, sooner if the disk they live on runs low. The last hash of each deleted day is kept so the remaining chain still verifies.

Who else processes data

The services that process data on our behalf are listed on the Subprocessors page. How we handle personal data is in the Privacy Notice and the Data Processing Addendum.

Why the masking engine is closed

The n8n node is open source (MIT) with no runtime dependencies, so you can read exactly what it sends and where. The masking engine stays closed because publishing it would hand people a map of what to avoid. We publish what it masks and how to test it on your own text.

Report a security issue

Please write to [email protected] with "Security" in the subject. We reply within 3 business days.

• The Vrymdor™ Arena is the only place to test attacks on the AI Node. It runs against an isolated copy, with fake values only.
• Never test against production, customer accounts or real data.
• Good-faith research that follows these rules won't face legal action.

Our disclosure policy explains what to include and what we promise in return. Our contact is also in security.txt.