Last updated September 11, 2026

Privacy notice

This notice explains the information BIOMUNE processes when someone visits the public site, signs in, or uses the governed-action service.

Information BIOMUNE processes

BIOMUNE may process account identifiers supplied by the configured identity provider; tenant and permission claims; registered resource metadata; authority decisions; operation states; fixed failure codes; cryptographic digests; timestamps; provider result metadata; signed receipts; and security and reliability logs.

Information intentionally excluded

BIOMUNE is designed to keep provider passwords, API tokens, deploy hooks, Relay private keys, raw SQL, and unrestricted workflow payloads out of AI conversations, routine receipts, and customer-facing operational views. A customer-managed Relay keeps supported provider credentials inside the customer’s own security boundary.

Why information is used

Information is used to authenticate users, enforce tenant and permission boundaries, evaluate authority, execute and observe approved actions, produce evidence, investigate failures, prevent abuse, and maintain the service.

Service providers

BIOMUNE relies on contracted infrastructure, identity, source-control, and security providers to operate the service. Provider access is limited by service role and operational need.

Retention and security

Operational and signed evidence may be retained to preserve the integrity of the audit record, meet customer agreements, and support security investigations. Retention periods and deletion obligations are defined in the applicable customer agreement. No internet service can guarantee absolute security.

Requests and questions

To ask about access, correction, deletion, retention, or another privacy matter, email BIOMUNE privacy support. Identity and evidence records may need to be retained where deletion would undermine a required security or audit record.