Privacy Policy
Effective October 30, 2026. This policy covers the Trazio assistant service at trazio.cerebrixos.com (the "Service"), operated by Ockham Labs Inc. ("we", "us"), Ontario, Canada. The data inside your Trazio pipeline is governed by your organisation's Trazio agreement; this policy covers what the Service itself handles.
What we collect
- Sign-in details: your organisation ID and, for Trazio accounts, your email address. Passwords are stored only as salted one-way hashes. If your organisation uses its own identity provider, we receive the tokens it issues, not your password.
- Connection records: the name and redirect address of each assistant app you connect, and the access grants it holds (stored encrypted).
- Security counters: failed sign-in counts, kept for 15 minutes, and request-rate counters, kept for about a minute.
- Operational logs: request time, address, status and duration, used to run and secure the Service and kept for up to 7 days. These logs do not contain the results returned to the assistant.
What we do not keep
When an assistant calls a tool, the Service forwards the request to your Trazio pipeline and returns the answer to that assistant. We do not keep copies of the events, recordings, video or answers that pass through. We do not sell personal information and do not use it to train AI models.
Who receives data
- The assistant you connect (for example Anthropic's Claude or OpenAI's ChatGPT) receives the results of the tools it calls, on your behalf. Its provider handles that data under its own terms and privacy policy.
- Cloudflare, Inc. hosts the Service. Requests may pass through Cloudflare locations near the user; your stored pipeline data stays in its Trazio region.
- Authorities, only where required by law.
How long we keep it
Access tokens last at most one hour. Grants end after 30 days without use, when you revoke them in your assistant, or when your account or organisation is disabled. Account records are deleted on request or when your organisation's Trazio agreement ends.
Your choices and rights
You can disconnect an assistant at any time from its settings. Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other laws that apply to you, you can ask to access or correct your personal information, or withdraw consent, by writing to vc@cerebrixos.com. If we cannot resolve a concern, you may contact the Office of the Privacy Commissioner of Canada.
Security
All traffic is encrypted in transit. Access is read-only, limited to one pipeline, protected by PKCE sign-in, and rate-limited. No security measure is perfect; we will notify affected organisations of a breach as the law requires.
Children
The Service is for business use and is not directed at children.
Changes
We will post any change here with a new effective date, and tell organisations directly about significant changes.
Contact
Ockham Labs Inc. — vc@cerebrixos.com