Feint
Last updated 2026-10-13

Privacy policy

What Feint holds, who processes it, and for how long.

Feint is a service of Feint Security ("we"). It creates decoy credentials for your systems and tells you when one is used. This policy says what information the service handles, why, who else touches it, and how long it is kept. It is written for the people who run Feint for their organization and for the people whose actions a decoy might record.

What Feint holds about your account#

Sign-in and organization data comes from Clerk, which runs sign-in for Feint: your name, email address, the authentication method you chose, and the organization you belong to with your role in it. Feint keeps a copy of the organization's name and of each member's email so it can show them to you and send alerts.

Billing data is held by Stripe. Feint never sees or stores card numbers. It stores Stripe's identifiers for your customer and subscription, your plan, and its status.

What you type into Feint: the placement you describe for each decoy, any metadata you attach, the names of your API keys, the email addresses you nominate for alerts, and the webhook endpoints you register. Placements and metadata are repeated in alerts, so write them for the people who will read those.

Request logs: like any web service, Feint logs requests to the site and the API with the network address they came from. The logs never contain credentials.

What a decoy records#

A decoy is a real credential on a platform we control, built to grant nothing. When someone uses one, the platform records the attempt and Feint records what the platform reports:

  • the time of use;
  • the network address it came from, when the platform recorded one;
  • the user agent, when the platform recorded one;
  • the calls that were attempted and how the platform answered them.

For GitLab decoys this is GitLab's record of the token's last use. For AWS decoys it is the CloudTrail record of each call made with the key. These records describe whoever used the decoy, which is usually someone who should not have had it. They are shown to your organization's members, sent in alerts to the addresses you nominate, and delivered to the webhook endpoints you register. Feint does not try to identify that person beyond what the record says.

How the information is used#

To run the service: create and watch decoys, raise alerts, deliver them, and show them in the console and the API. To bill you. To keep the service and its users safe, including rate limiting and abuse prevention. To answer when you write to us. Not for advertising, and not sold or rented to anyone.

Who else processes it#

Feint runs on services operated by others, each under its own terms and its own privacy policy. Each receives only what its job needs:

  • Clerk runs sign-in and organizations, and holds the account data described above.
  • Stripe takes payments and issues invoices, and holds your card and billing details.
  • An email delivery service carries the alerts and confirmations Feint sends, so it handles the recipient address and the message.
  • A hosting provider runs the application and its database, and an edge network in front of them terminates connections and filters abusive traffic. Both handle request metadata, including network addresses.
  • The platforms the decoys live in hold each decoy and record its use, as described above.

These services process the information in the United States; the edge network operates worldwide. A list of the providers is available to customers on request. We may also disclose information when the law requires it, or to protect the service and its users.

Cookies#

Clerk sets the cookies that keep you signed in, on feintsecurity.com and its subdomains. Stripe sets cookies on its own hosted checkout and billing pages. The edge network in front of the site sets a cookie for bot protection. All of them are needed for the service to work; none is used for advertising or cross-site tracking, and Feint runs no analytics scripts.

How long it is kept#

  • Account and organization data: while the account or organization exists, then deleted when you remove it in the console or ask us to.
  • Decoys, alerts and the records of a decoy's use: while the organization exists. Revoking a decoy keeps its history; deleting the organization removes it.
  • The platform's own records behind AWS alerts, which Feint keeps as received: 365 days, then deleted.
  • Request logs: about 30 days.
  • Database backups: up to about 90 days, after which the deleted data is gone from them too.

Security#

The service is reached only over TLS. Decoy secrets are shown once and not stored; Feint keeps a fingerprint, not the secret. Webhook signing secrets are stored encrypted. Access to the platforms the decoys live in is held by narrowly scoped service identities. If you believe you have found a vulnerability, security.txt says how to tell us.

Your choices and rights#

You can see and change your own details and your organization's in the console, delete your account from the Account page, and remove alert addresses and webhook endpoints at any time. Depending on where you live you may have further rights over your personal information, including access, correction, deletion, portability and objection. Write to [email protected] and we will respond. Feint is for organizations and is not directed at children.

Changes#

We will post changes here with a new date and, for anything material, tell account administrators by email before it takes effect.

Contact#

Feint Security, Washington, United States. [email protected].