Privacy Policy.
EarlyBird AI, LLC d/b/a Threat.Blue (“Threat.Blue,” “we,” “us”) collects only the minimum information needed to respond to briefing requests, coordinate vulnerability disclosures, and protect our infrastructure. We run zero third-party trackers and set zero advertising cookies.
Zero tracking by design
threat.blue enforces a strict browser Content Security Policy
(default-src 'none') that blocks external scripts, tracking pixels, cross-site frames, and
third-party font beacons at the network edge:
- No cookies or local storage identifiers are set when you browse
threat.blue. - No third-party analytics, behavioral profiling, or ad networks are loaded on any page.
- No sale or sharing of personal information as defined under the CCPA/CPRA or GDPR.
Information we collect
We process three narrow categories of information:
| Category | Data Elements | Purpose & Retention |
|---|---|---|
| Briefing Requests | Work email address, organization name, and selected technical scope (Source code, Binaries and firmware, Both, or Not sure yet). |
Routed directly via encrypted email to authorized EarlyBird AI security leadership to verify organization identity and schedule a briefing. Lambda operational logs expire automatically after 30 days. |
| Inbound Email | Sender address, headers, and message content sent to security@threat.blue or hello@threat.blue. |
Used to coordinate vulnerability disclosures, answer legal/security inquiries, and manage active engagements. Raw inbound transit objects in S3 automatically expire after 30 days. |
| Edge Firewall Telemetry | Transient IP address, URI path, and HTTP request metadata processed by AWS CloudFront and AWS WAF. | Used exclusively for DDoS mitigation, form rate limiting (10 requests per 5 minutes), and abuse prevention under legitimate security interest. |
Customer code & engagement data
When EarlyBird AI, LLC processes Customer repositories, binaries, or contributor metadata during an authorized security engagement, we act as a Data Processor on Customer’s behalf under our Data Processing Addendum:
- Engagement environments are single-tenant, network-isolated, and destroyed upon completion.
- Customer code, binaries, and vulnerability findings are never used to train AI models.
- We recommend omitting production personal data (PII/PHI) from test fixtures; any incidental personal data in git commit history is processed solely to deliver remediation pull requests.
Infrastructure providers & transfers
threat.blue is hosted in the United States (us-east-1) on Amazon Web Services
(CloudFront, S3, Lambda, WAF, and SES) with operator business mail handled via Google Workspace under
enterprise data-protection agreements. Where personal data is transferred from the EEA, UK, or
Switzerland, transfers are safeguarded by the EU Standard Contractual Clauses (SCCs) incorporated into our
Data Processing Addendum.
Your privacy rights & contact
Depending on your jurisdiction (including the EEA, UK, California, and other US states), you have the right to request access to, correction of, deletion of, or restriction of processing of personal data we hold about you.
To exercise any privacy right or contact our Data Protection lead at EarlyBird AI, LLC, email security@threat.blue. We verify and respond to all requests within 30 days.