Privacy policy

“Musha Security” (“Musha”, “we”) operates, under the laws of the Republic of Colombia, the vulnerability detection platform available at mushasec.com and app.mushasec.com. This policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over it. It is written to comply with Colombia’s Law 1581 of 2012 and its regulatory Decree 1377 of 2013, as well as the EU’s GDPR for users in the European Economic Area.

01. Data controller

Commercial name	Musha Security
Address	Bogotá D.C., Colombia
Website	mushasec.com
Privacy email	[email protected]
Legal email / notifications	[email protected]

The full legal identification of the controller (legal name, registrations, tax ID, physical address) is provided in writing to customers who sign a Service contract, to data subjects exercising Habeas Data rights before authorities, or to competent authorities (SIC, DIAN, courts) upon written request to [email protected].

02. Personal data we collect

A. From registered users (Customer):

• Name, email, profile photo (provided at signup)
• Organization you belong to and your role (owner / admin / member)
• Activity data: login timestamps, actions performed on the platform, source IP
• Configuration preferences (notifications, plan, language)

B. From service operation:

• OAuth tokens from your integrations (GitHub, GitLab, Azure DevOps, Bitbucket), encrypted with AES-256-GCM at rest
• Repository URLs, branch names, pull request identifiers
• Detected vulnerability findings (file path, line number, rule identifier, severity). We do not store source code.
• When someone in your organization opens a finding, the token you granted reads the lines around it. Those lines are not stored, each read is logged, and an administrator can turn this off.
• Audit log of all actions (who did what and when)

C. For billing:

• Billing information processed by an authorized third party acting as seller to the Customer (name, address, country). Musha does not directly store card data.
• Subscription status (plan, billing cycle, next billing date)

D. From website visitors:

• Enterprise contact form data (name, corporate email, team size, message)
• Browsing data collected automatically (IP, user agent, pages visited)

E. Sensitive data:

Musha does not collect sensitive data as defined in Article 5 of Colombian Law 1581 of 2012 (health data, sexual orientation, political ideology, religious beliefs, biometric data, etc.). If we ever need to collect any in the future, we will request your express and separate authorization, clearly indicating which sensitive data and for what purpose.

03. Data subject authorization

In accordance with Article 9 of Colombian Law 1581 of 2012 and Article 5 of Decree 1377 of 2013, your authorization for the processing of the personal data described in this policy is obtained freely, in advance, expressly, in an informed and unequivocal way, at the moment of:

• Creating an account at app.mushasec.com, by ticking the mandatory acceptance checkbox for the Terms of Service and this Privacy Policy during signup.
• Submitting the Enterprise contact form on mushasec.com, which includes a visible notice of acceptance of data processing.
• Connecting an OAuth integration (GitHub, GitLab, Azure DevOps, Bitbucket): consent is granted by authorizing the requested OAuth permissions.

This authorization can be revoked at any time by writing to [email protected]. Revocation will not affect the lawfulness of processing based on consent prior to revocation, but will imply termination of the Service if processing is essential to providing it.

04. Purposes of processing

Personal data is used to:

• Deliver the vulnerability analysis service (SAST, SCA, IaC and Secret Scanning) for the repositories you have connected
• Notify you about detected vulnerabilities, completed or failed scans, and severity changes
• Process payments and manage your subscription through an authorized third party
• Provide technical support when you request it
• Fulfill legal and contractual obligations
• Improve the product through aggregated, anonymous analytics (not individualized)

We do not sell your data to third parties. We do not use it for advertising outside Musha. And we do not share your source code with anyone, under any circumstance.

05. Legal basis for processing

• Contract performance: to provide the service you contracted (GDPR Art. 6(1)(b))
• Legitimate interest: for platform security, fraud prevention and product improvement (GDPR Art. 6(1)(f))
• Consent: for opt-in marketing communications and analytics cookies (GDPR Art. 6(1)(a) + Colombian Law 1581 Art. 9)
• Legal obligation: for retention of tax and accounting records (GDPR Art. 6(1)(c))

06. Data subject rights

Per Article 8 of Colombian Law 1581 of 2012 and Articles 15 to 22 of the GDPR, you have the following rights:

• Access: know what personal data we hold about you
• Rectification: update incorrect or outdated data
• Erasure (right to be forgotten): request deletion of your data
• Portability: receive your data in a structured format (JSON / CSV)
• Objection: object to processing based on legitimate interest
• Restriction: request that we pause processing temporarily
• Withdrawal of consent: withdraw consent given for specific purposes
• Complaints to the authority: file complaints with the SIC (Colombia) or your local data protection authority

To exercise these rights, write to [email protected] with the subject “Habeas Data - [your name]”. We respond within a maximum of 10 business days (Colombia, Art. 14 Law 1581) or 30 days (GDPR, Art. 12.3), extendable by 5 business days if complexity requires, per Art. 21 of Decree 1377 of 2013.

Automated decisions: Musha does not make automated decisions with significant legal effects, nor does it profile data subjects within the meaning of Article 22 of the GDPR. Processing is operational, to deliver the security analysis service you have contracted.

07. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes of processing:

• Active account: while your subscription is active
• After cancellation: the account becomes read-only for 30 days. You can sign in and view your information, but cannot create scans or new resources. Five days before deletion we notify the administrators by email. On day 31 the data is permanently and automatically deleted by a scheduled process.
• Tax records: 5 years per Colombian DIAN obligations (Tax Statute Art. 632)
• Anonymized audit logs: up to 7 years for legal defense and information-security obligations

08. Security

We implement industry-standard technical and organizational measures: encryption at rest and in transit, multi-tenant isolation at the database level, role-based access control, complete audit logging, MFA available for users, and audited providers. Technical detail (specific algorithms, architecture, SOC 2 controls) is available upon request to [email protected] for customers and prospects under NDA.

09. Cookies and similar technologies

We use strictly necessary cookies for authentication (session management) and CSRF prevention; these do not require consent. Analytics cookies, if we activate them in the future, will require explicit consent through a notice. We do not use third-party advertising cookies.

10. Minors

Musha is a B2B service for companies. It is not directed at minors under 18, we do not accept individual signups, and we do not knowingly collect data from minors. If you discover that a minor has provided data by mistake, email [email protected] and we will delete it within a maximum of 10 business days.

11. DMCA and third-party intellectual property

Musha respects third-party intellectual property rights. If you believe that content on mushasec.com or in findings detected by our Service infringes your copyright, send a DMCA notice per 17 U.S.C. § 512 to:

DMCA agent	Musha Security
Email	[email protected]
Subject	DMCA Notice - [URL]

The notice must include: identification of the infringed work, its location on Musha, your contact information, a good-faith statement and an electronic signature.

12. Modifications

We may modify this policy. Substantial changes are notified at least 60 days in advance to your registered email, consistent with the notification period for changes to the Terms of Service. If you do not accept the changes, you may exercise your right to cancel the subscription before the effective date. Continued use of the service after the effective date implies acceptance of the modifications.

13. Contact

Privacy and personal data	[email protected]
Security and vulnerability disclosure	[email protected]
General support	[email protected]
Supervisory authority (Colombia)	Superintendencia de Industria y Comercio - sic.gov.co