Privacy

Last updated 11 November 2026.

We never store or log the content you submit. For each check we log only four things: a SHA-256 hash of the content, its size, the verdict, and how long the check took.

What happens to your content

• Your content is held in memory for the length of the request, checked, and then discarded.
• It is not written to a database, a file, a log or an analytics tool. There is no database in this service.
• The optional source field is not stored or logged either.
• Findings and excerpts are returned to you and are not kept by us.

What we log

• A SHA-256 hash of the content. A hash cannot be turned back into the content.
• The size in bytes.
• The verdict.
• The latency in milliseconds.

The model layer

If the pattern layer does not already find an injection, your content is sent to a language model provider (Anthropic) for a second opinion. It is sent only to produce your verdict. The provider processes it under its own API terms and may keep it for a limited time for its own safety and abuse monitoring. We do not use your content to train anything.

Rate limiting

The free tier is limited per IP address. To count requests we store a one-way hash of your IP address with a counter in Redis (Upstash). It expires after a day. We do not store the raw IP address ourselves.

Hosting

The service runs on Vercel. Like any host, Vercel processes network data such as IP addresses to deliver and protect the service, under its own privacy terms.

Cookies and tracking

None. No cookies, no ad trackers, no accounts.

Contact

Questions about privacy: privacy@injectioncheck.com.