Data Security

Overview

This Data Security overview describes how Neander Inc. approaches security for the Neander website, desktop application, downloads, integrations, support interactions, and related services. Neander Inc.’s mailing address is 2261 Market Street STE 91081, San Francisco, CA 94114.

This page explains the shared security model in practical terms.

Scope

This overview covers information handled by Neander when users visit the website, download or use the desktop app, connect integrations, use AI features, submit support requests, or participate in organization-managed accounts or licenses.

It does not describe every control used by third-party AI providers, repositories, package registries, identity services, app stores, or other integrations. Those services operate under their own security models and user-configured permissions.

Shared Responsibility

Security for a desktop AI coding tool is shared between Neander, the user, and any organization or third-party service connected to the workflow.

• Neander is responsible for designing and operating the website, desktop app, update channels, support workflows, and product systems with reasonable security practices.
• Users are responsible for device security, local repositories, secrets, credentials, connected permissions, prompt contents, command approval, and review of generated code.
• Organizations are responsible for their own access policies, repository permissions, endpoint management, identity controls, internal approval workflows, and employee use rules.
• Third-party services are responsible for their own platforms, terms, settings, and security controls.

Desktop App Security Model

Neander runs as a desktop application and may interact with files, repositories, terminal sessions, developer tools, and integrations based on user configuration and requested features. That local context can make the product more useful, but it also means users should treat Neander like other development tools with access to sensitive project materials.

Users should review project access, command execution, generated patches, file changes, integration permissions, and prompts before approving workflows or using outputs in production.

Data Flows

Depending on the feature used, Neander may process information locally on the device, send information to Neander-operated systems, or transmit selected information to AI providers or connected integrations. Information may include prompts, selected files, repository context, project context, outputs, diagnostics, app metadata, and integration metadata.

Neander does not use user code, prompts, files, repository context, project context, outputs, or other user content to train AI models.

Access Management

Neander limits internal access to personal information and User Content to people and services that need access for product operation, support, security, or legal compliance, and periodically reviews internal access to information it handles. Support access is limited to authorized personnel and appropriate support needs. For organization-managed accounts, organization administrators can manage organization access, seats, settings, integrations, and related metadata as applicable. Relevant administrative and security activity may be logged to support monitoring, investigation, and accountability.

Development Practices

Neander considers security during product design, implementation, testing, release, and support, including review of prompt handling, local file access, command execution, update delivery, integration permissions, credential and token handling, diagnostics, dependencies, and generated-code workflows.

Incident Response

If Neander identifies a security incident affecting information it handles, Neander investigates, takes steps designed to contain and remediate the issue, and notifies affected users or organizations where required by law or appropriate under the circumstances.

The timing and content of notices may depend on the facts available, the type of information involved, applicable legal requirements, law-enforcement needs, and remediation status.

Vulnerability Reporting

If you believe you have found a vulnerability or security issue involving Neander, please report it to support@neander.ai.

Reports should include enough detail for Neander to understand and reproduce the issue. Please avoid accessing, modifying, deleting, or sharing data that does not belong to you.

User Responsibilities

• Keep your device, operating system, browser, developer tools, and Neander app updated.
• Protect local repositories, credentials, secrets, environment files, keys, tokens, and package credentials.
• Review generated code, commands, patches, and configuration changes before use.
• Use least-privilege scopes for repositories, issue trackers, package registries, identity services, and other integrations.
• Rotate exposed credentials and remove secrets from prompts, logs, support requests, and repositories where possible.
• Follow your organization's policies for source code, confidential information, regulated data, open-source use, and AI-assisted development.

Deletion and Retention Relationship

Deletion and retention are described in the Privacy Policy. Security logs, support records, diagnostics, and organization-managed account records that Neander receives or stores are retained for up to 365 days.

After 365 days, applicable data is deleted or anonymized unless a longer period is required by law, needed to resolve disputes, enforce agreements, address security incidents, or requested or controlled by you or your organization where appropriate. This does not mean Neander retains local files, repositories, or project materials that remain only on your device.

Third-Party Integrations

Neander may connect to categories of third-party services such as AI providers, source-code hosts, issue trackers, package registries, identity services, app distribution services, support tools, analytics, and communications tools. Users and organization administrators should review each integration's requested scopes, settings, and security model.

Legal Requests and Law Enforcement

Neander may preserve or disclose information when required by law, legal process, or enforceable government request, or when necessary to protect safety, security, rights, or the integrity of the product. Neander reviews legal requests before responding where appropriate.

Changes

Neander may update this Data Security overview as the product, security practices, integrations, or legal requirements change. The date at the top of this page should identify when this overview was last updated.

Contact

Questions about this Data Security overview should be sent to support@neander.ai.

For privacy questions or rights requests, contact privacy@neander.ai.

Neander Inc.
2261 Market Street STE 91081
San Francisco, CA 94114