{
  "name": "AI vendor breach-notification register",
  "url": "https://valaisos.com/registers/ai-vendor-breach-notification/",
  "version": "1.2",
  "dateModified": "2026-09-17",
  "temporalCoverage": "2026-08-12/2026-09-17",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "method": "For each vendor, ValaisOS read the privacy policy, the terms of service, a data processing agreement where one is published, a subscription agreement where one is published, and any security or trust page, on the reviewed date. Each entry names and links the document and section where a deadline appears, with the last-updated date the document shows. Pages that render only in a browser were read in a browser. Gated trust centers were not read; their contents are recorded as not publicly verifiable. Of twenty-seven companies reviewed, nineteen published enough to assess.",
  "columns": [
    "Vendor",
    "Published deadline",
    "Where we found it",
    "Runs to"
  ],
  "rows": [
    {
      "Vendor": "WealthAi",
      "Published deadline": "48 hours (as read 2026-08-12; the PDF was not reachable on 2026-09-09)",
      "Where we found it": "Data processing agreement §9.1, a PDF linked from the customer privacy notice (notice last updated August 2026); the download link returned a 404 on 2026-09-09",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "customer privacy notice",
          "url": "https://wealthai.tech/privacy"
        }
      ]
    },
    {
      "Vendor": "Egnyte",
      "Published deadline": "72 hours",
      "Where we found it": "Data protection addendum §E.5.1 and §F.1.3 (updated July 2026)",
      "Runs to": "Customer's administrator",
      "documents": [
        {
          "text": "Data protection addendum",
          "url": "https://www.egnyte.com/data-protection-addendum"
        }
      ]
    },
    {
      "Vendor": "FastTrackr AI",
      "Published deadline": "72 hours",
      "Where we found it": "Privacy policy, \"Data breach notification,\" and terms of service, \"Data Breach Notification\" (both last updated November 18, 2025)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://fasttrackr.ai/privacy-policy"
        },
        {
          "text": "terms of service",
          "url": "https://fasttrackr.ai/tos"
        }
      ]
    },
    {
      "Vendor": "Hadrius",
      "Published deadline": "72 hours, scoped to Regulation S-P data",
      "Where we found it": "Terms and conditions §5.5 (effective January 1, 2026)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Terms and conditions",
          "url": "https://www.hadrius.com/msa"
        }
      ]
    },
    {
      "Vendor": "Hazel",
      "Published deadline": "72 business hours",
      "Where we found it": "Altruist Software Subscription Agreement §11.3 (v20230403), incorporated by the Hazel Terms of Use (v20260629)",
      "Runs to": "Subscriber",
      "documents": [
        {
          "text": "Altruist Software Subscription Agreement",
          "url": "https://altruist.com/legal/software-subscription-agreement/"
        },
        {
          "text": "Hazel Terms of Use",
          "url": "https://altruist.com/legal/hazel-terms-of-use/"
        }
      ]
    },
    {
      "Vendor": "Jump",
      "Published deadline": "72 hours from a suspected breach",
      "Where we found it": "Data processing agreement §7.1 (no date shown)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Data processing agreement",
          "url": "https://jump.ai/dpa"
        }
      ]
    },
    {
      "Vendor": "Orion",
      "Published deadline": "72 hours, mutual between both parties",
      "Where we found it": "Data protection addendum §V (last updated May 22, 2026)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Data protection addendum",
          "url": "https://orion.com/download/data-protection-addendum"
        }
      ]
    },
    {
      "Vendor": "SideDrawer",
      "Published deadline": "72 hours",
      "Where we found it": "Data processing agreement §8.1 (last updated November 7, 2022), also Appendix A of the privacy policy (last updated August 28, 2026)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Data processing agreement",
          "url": "https://www.sidedrawer.com/legal/dpa"
        },
        {
          "text": "privacy policy",
          "url": "https://www.sidedrawer.com/legal/privacy-policy"
        }
      ]
    },
    {
      "Vendor": "Strata AI",
      "Published deadline": "72 hours",
      "Where we found it": "Privacy policy §19 (last updated July 17, 2026) and security page",
      "Runs to": "Affected users",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://strataai.org/privacy"
        },
        {
          "text": "security page",
          "url": "https://strataai.org/security"
        }
      ]
    },
    {
      "Vendor": "Zocks",
      "Published deadline": "72 hours, unless the firm's MSA specifies otherwise",
      "Where we found it": "Terms of service §6.4 (last updated October 8, 2025)",
      "Runs to": "Customer firm",
      "documents": [
        {
          "text": "Terms of service",
          "url": "https://www.zocks.io/terms-of-service"
        }
      ]
    },
    {
      "Vendor": "Hamachi.ai",
      "Published deadline": "Notice promised, no period stated",
      "Where we found it": "Privacy policy §4 (effective February 17, 2026)",
      "Runs to": "Affected users",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://hamachi.ai/privacy"
        }
      ]
    },
    {
      "Vendor": "SS&C Black Diamond",
      "Published deadline": "We found notice provisions only in the Australian and South African annexes",
      "Where we found it": "SS&C privacy statement (last updated July 24, 2026); the Black Diamond copy still shows March 27, 2023",
      "Runs to": "Not stated for US customers",
      "documents": [
        {
          "text": "SS&C privacy statement",
          "url": "https://www.ssctech.com/about/privacy"
        },
        {
          "text": "Black Diamond copy",
          "url": "https://www.sscblackdiamond.com/privacy/"
        }
      ]
    },
    {
      "Vendor": "Verapath",
      "Published deadline": "Notice by posting to their website, no period stated",
      "Where we found it": "Privacy policy, \"Data breach\" (last updated April 27, 2026)",
      "Runs to": "Website visitors",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://app.websitepolicies.com/policies/view/6p0hooye"
        }
      ]
    },
    {
      "Vendor": "eMoney Advisor",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy policy (last updated July 1, 2025) and terms of use (last revised December 16, 2024)",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://emoneyadvisor.com/privacy-policy/"
        },
        {
          "text": "terms of use",
          "url": "https://wealth.emaplan.com/ema/Legal/Terms"
        }
      ]
    },
    {
      "Vendor": "Lira AI",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy policy and terms of use (both dated only \"2025\")",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://getlira.ai/privacy-policy"
        },
        {
          "text": "terms of use",
          "url": "https://getlira.ai/terms-of-use"
        }
      ]
    },
    {
      "Vendor": "Masttro",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy policy (last updated January 26, 2024); we could not find a terms document on masttro.com",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://masttro.com/privacy-policy"
        }
      ]
    },
    {
      "Vendor": "VastAdvisor",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy policy (last updated March 25, 2026) and terms and conditions (last updated April 13, 2026)",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy policy",
          "url": "https://www.vastadvisor.ai/vastadvisor-privacy-policy"
        },
        {
          "text": "terms and conditions",
          "url": "https://www.vastadvisor.ai/vastadvisor-terms-conditions"
        }
      ]
    },
    {
      "Vendor": "Verlo",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy statement (effective August 11, 2026) and terms of service (last updated January 6, 2025)",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy statement",
          "url": "https://verlo.finance/privacy"
        },
        {
          "text": "terms of service",
          "url": "https://verlo.finance/terms.html"
        }
      ]
    },
    {
      "Vendor": "WealthFluent",
      "Published deadline": "We did not find a provision",
      "Where we found it": "Privacy and security policy (last updated April 13, 2026) and terms of use (last updated July 15, 2025)",
      "Runs to": "Not applicable",
      "documents": [
        {
          "text": "Privacy and security policy",
          "url": "https://wealthfluent.com/privacy/"
        },
        {
          "text": "terms of use",
          "url": "https://wealthfluent.com/terms-of-use/"
        }
      ]
    }
  ],
  "changelog": [
    "2026-08-12. Register created from the August 12, 2026 review of nineteen vendors' public documents. All rows as of that date.",
    "2026-09-17. Key fact on notice recipients clarified: Strata AI's clause runs to its account holders rather than to the customer firm as an entity, so the fact now reads nine to the customer firm or its administrator, one to account holders, none to the firm's clients or a regulator. No row changed. The register now publishes its rows as JSON and CSV. Version 1.2.",
    "2026-09-09 (second entry). All nineteen rows re-read from the vendors' current documents, with the document URL and its last-updated date now recorded in the table. No published deadline, location, recipient, or qualifier changed. Document dates moved for several vendors (Egnyte data protection addendum July 2026; SideDrawer privacy policy August 28, 2026, now carrying the data processing agreement as Appendix A; Orion data protection addendum May 22, 2026; Verapath privacy policy April 27, 2026; WealthFluent privacy policy April 13, 2026; VastAdvisor privacy policy March 25, 2026 and terms April 13, 2026). One document location corrected, eMoney Advisor's terms of use are at wealth.emaplan.com, not emoneyadvisor.com. WealthAi's document download returned a 404 on this pass, so its row stays as read on August 12 with the note. A terms document for Masttro could not be found on masttro.com; the row now says so. Version 1.1.",
    "2026-09-09. Strata AI row re-verified against the privacy policy at strataai.org (last updated July 17, 2026): section 19 still commits to notifying affected users within 72 hours of becoming aware of a breach. WealthAi row annotated: the data processing agreement PDF read on August 12 was reachable from the site's privacy page; on September 9 the site's document download link returned an HTML page instead of the PDF, so the clause could not be re-read. The entry is retained as recorded on August 12 with that note. Other rows not re-verified on this date."
  ]
}