Legal
Privacy notice
Bulkhead is a certification service for AI agents, operated by Graylark Technologies Limited (company number 15528848), registered in England and Wales. We are the controller of the personal data described here. Last updated 4 September 2026.
The part most people are asking about. Certification sends synthetic test messages to an endpoint you control and records the replies. No personal data of your users is involved at any stage, so we do not process personal data on your behalf and there is no data processing agreement for you to sign. What we hold is ordinary business-contact and billing information about the person who bought a certificate. The full technical picture is on the trust page.
What we collect
- Account details - name, work email address, company name and domain, given when registering an agent or buying a certificate.
- Billing details - the amount, currency, and Stripe’s references for the payment. Card numbers are handled entirely by Stripe and never reach us.
- Certification records - the agent details you registered, the endpoint you nominated, what your agent replied to our test messages, and the resulting attestations. This is technical data about a software system, not about a person.
- Correspondence - anything you send us by email.
- Basic request logs - IP address and user agent, kept transiently by our hosting provider for security and abuse prevention.
We do not use tracking cookies, advertising pixels or third-party analytics on this site.
Why we hold it, and on what basis
- To deliver certification - running the suite, issuing and maintaining seals, and emailing you about them. Basis: performance of a contract.
- To publish what a certificate means - a live seal appears in our public directory with the agent, the certifying organisation, the level and the check history. That publication is the product. Basis: performance of a contract.
- To keep records - company, tax and audit obligations. Basis: legal obligation.
- To keep the service safe and improve it - abuse prevention, debugging, and understanding where the suite is unclear. Basis: legitimate interests.
We do not sell personal data, we do not share it for advertising, and we do not use your agent’s replies to train models.
Who we share it with
Only the service providers needed to run Bulkhead, each under contract and each named openly on the trust page: Cloudflare (hosting, database, evidence storage), Stripe (payments) and Resend (transactional email). Judged replies are read by Bulkhead’s own evaluation fleet, which is our own infrastructure operated by us rather than a third-party model provider, so they are not shared with anyone.
We will disclose data where the law requires it. If we are ever compelled to hand over customer data, we will tell the customer unless we are prohibited from doing so.
Where it lives
Primary storage is in the UK and EU. Some providers above operate globally, so limited transfers outside the UK take place under the UK International Data Transfer Addendum or equivalent safeguards.
How long we keep it
- Certification evidence for a live seal: the life of the seal plus one year.
- Routine monitoring checks that passed: a summary and a hash only - we deliberately do not retain a transcript of every check.
- Account and billing records: for as long as you hold a seal, then as required for UK company and tax records, normally six years.
- Correspondence: up to two years.
Your rights
Under UK GDPR you may ask for a copy of your personal data, ask us to correct or erase it, object to or restrict processing, and ask for it in a portable form. Where processing rests on legitimate interests you may object at any time.
One limit worth stating plainly: while a certificate is live and published, we cannot erase the record that supports it without withdrawing the certificate, because a published seal that no evidence backs would mislead the people relying on it. Ask us to withdraw the seal and the evidence can go with it.
Write to [email protected] and we will answer within 30 days. If you are unhappy with the outcome you may complain to the Information Commissioner’s Office at ico.org.uk.
Security
Attestations are signed with Ed25519 and independently verifiable offline. Credentials are stored only as hashes and are scoped to a single agent. Every change to a seal’s status is written to an append-only audit log with a mandatory reason. The trust page covers this properly, including what our probes can and cannot do.
Changes
We will update this notice as the service changes and will date every revision. Material changes affecting existing customers will be emailed, not quietly published.
Graylark Technologies Limited, company number 15528848, registered in England and Wales. Contact [email protected].