Is Cambric AI GDPR compliant?

Harpax is a local-only tool: the data it generates — session traces, detection events, audit logs — never leaves your machine. That architectural choice puts most GDPR concerns squarely in your control as the data subject. On the formal certification side, Cambric AI is actively working toward SOC 2, GDPR, and HIPAA compliance; we'll publish updates as each program advances.

Why local-only matters for GDPR

GDPR governs how personal data is collected, processed, stored, and transferred. The fewer of those activities Cambric performs, the smaller the compliance surface and the more control you retain. Harpax is structured so that, for the data Harpax itself captures during a Claude Code session:

• Cambric is not the data processor. Session JSONL files, detections, allowlists, and configuration are written to your filesystem under ~/.harpax/ — on your hardware, under your user account. Cambric AI has no access to them.
• There is no cross-border data transfer to manage. Nothing is uploaded to a Cambric-operated server, so there's no Schrems-II analysis to perform on the captured session data.
• Data-subject requests resolve to a local filesystem operation. You don't need to file an access or erasure request with Cambric to get to your Harpax data — it's already on disk, under your control.

The audit log Harpax generates

Harpax produces detailed, structured audit logs as part of normal operation. For each Claude Code session, you get:

• A timestamped JSONL stream of every tool call, prompt, response, and detection at ~/.harpax/sessions/<session-id>.jsonl
• An optional compressed long-term archive (SQLite) for fast historical queries
• Daemon-level operational logs under ~/.harpax/logs/

These logs are useful for GDPR-adjacent purposes — access-control auditing, incident investigation, demonstrating processing activities — and they're yours to retain, export, or delete on whatever schedule your organisation requires.

Data-subject rights, and where they apply

Right	How it's satisfied with Harpax
Right of access	Open ~/.harpax/sessions/ — the data is on your machine in a documented format.
Right to erasure ("right to be forgotten")	Delete the files in ~/.harpax/, or shorten retention.max_age_days, or set cleanup_on_session_end: true.
Right to data portability	JSONL is a portable, standards-friendly format. Use harpax export or copy the files directly.
Right to rectification	Session records are append-only by design (an audit log shouldn't be silently mutable). If a stored detection is inaccurate, you can quarantine or delete the affected session file and re-run with updated rules.
Right to object / restrict processing	Disable specific detection tiers in ~/.harpax/config.yaml, switch to passive mode, or stop the daemon entirely.

What Cambric AI does process

Some limited personal data is processed by Cambric AI in roles where we are acting as a service provider rather than as the operator of Harpax itself:

• Support correspondence. When you email [email protected] or open a ticket on the service desk, Cambric stores your message, contact information, and any attachments you provide for as long as needed to resolve the issue.
• Billing data (when applicable). Paid subscriptions are processed through Stripe, which is the data processor for payment information. Cambric retains the billing-portal record (email, plan, invoice history) for accounting and tax purposes.
• Website analytics. Cambric.ai uses standard web traffic measurement. Refer to the site's privacy notice for current details.

To exercise data-subject rights against any of the above (access, deletion, portability, objection), email [email protected] and identify yourself with the address tied to the data.

Working toward SOC 2, GDPR, and HIPAA

Cambric AI is actively building out the policies, controls, and audit artefacts required for:

• SOC 2 Type II — in progress. Targets the Trust Services Criteria around security, availability, and confidentiality.
• GDPR — in progress. Includes formal DPIA documentation, a sub-processor register, and a published DPA for customers who need one.
• HIPAA — in progress. Targets readiness to sign a Business Associate Agreement for healthcare customers using Harpax to monitor agents that touch PHI.

None of these certifications are complete today. We do not advertise Harpax as a certified solution and customers in regulated environments should treat Harpax's local-only architecture as the primary compliance argument until formal attestations are available.

Need a DPA or compliance documentation?

If your organisation needs a Data Processing Agreement, a vendor security questionnaire completed, or a written statement covering Harpax's data flows for an internal audit, contact us at [email protected]. We'll provide the most current documentation we have.