Privacy Policy
Last updated: June 2026
1. Data Interception & Processing
Sunder acts as a real-time data proxy. When we intercept webhooks or API payloads, we process the data entirely in-memory using AWS Aurora Serverless v2 and Node.js VM sandboxes. We do not persist your raw PII (Personally Identifiable Information) or downstream payload contents to disk. Data is temporarily evaluated for schema drift using vector embeddings (pgvector) and immediately forwarded to your intended destination.
2. Vector Embeddings & AI Models
Schema structures (keys, types, and hierarchical shapes) are converted into mathematical vector embeddings. These embeddings do not contain the actual values of your data (e.g., we embed the concept of a `customer_email` field, but not the email address itself). Our drift detection relies exclusively on these structural embeddings to ensure Zero-Knowledge processing.
3. Enterprise Security (OIDC)
Sunder utilizes Zero-Secret architecture. We use OpenID Connect (OIDC) to authenticate with AWS via ephemeral, short-lived STS tokens. We never store permanent database credentials, meaning there is no centralized database URL that can be leaked or compromised.
4. Compliance & SOC 2
This architecture is designed to support SOC 2 Type II, HIPAA, and GDPR compliance requirements out of the box by guaranteeing that intercepted data is never stored outside of your authorized VPC boundaries.
5. Contact
For security disclosures or privacy inquiries, please contact our engineering team at security@sunder.dev.