Privacy policy
NobleCloak does not sell or share personal information. We do not sell personal information to data brokers, and we do not share it with third parties for their own advertising purposes.
Who we are
NobleCloak was founded in 2026 as a United States company. NobleCloak is the controller of the personal information described in this policy. Questions or requests under this policy go to privacy@noblecloak.com.
Information we collect
| Category | Examples |
|---|---|
| Account and authentication data | Name, work email, organization, role, login credentials or SSO identifiers |
| Business contact data | Names and emails of people at prospect or customer organizations who interact with us (sales, support) |
| Billing data | Billing contact and invoice records, handled through our billing subprocessor |
| Support and correspondence | Content of support tickets, emails, or other messages you send us |
| Site usage data | Pages visited and general usage patterns on this site, collected via Google Analytics 4 with IP anonymization enabled |
| Customer content | Data you or your organization submit to the NobleCloak platform for processing. Its handling — including that it is excluded from model training — is described on the Security overview page, not repeated here. Identity-provider metadata scanned by Discover has its own page: Discover Data Handling |
| Tool-call records | Records of tool calls made through our Claude connector or observed by our Claude Code plugin. What each one transmits differs materially — see Connecting Claude to NobleCloak below |
How we use it
We use personal information to: operate and provide the service; authenticate users and secure accounts; respond to support requests and other correspondence; send account, billing, and security-related notices; process payments; detect and prevent fraud and abuse; and comply with legal obligations. We do not use personal information to train AI models, and we do not use it for third-party advertising.
Connecting Claude to NobleCloak
We ship two ways to connect Claude to the platform. They are not equivalent in what they send us, and the difference is the point of this section.
The Claude connector
The connector is installed once by an administrator and reaches Claude Desktop, claude.ai, Cowork, and mobile. It is a hosted server that runs tools on your behalf, so a tool's arguments and its results necessarily reach the platform — that is what executing a tool means, not an incidental collection. When you ask Claude to do something through a connected tool, we receive what you asked it to do.
Those calls are recorded in the Execution Ledger, the org-scoped audit log described on the Security overview page. A ledger entry includes the tool invoked, who requested it, the arguments it was called with, the result, and how our governance layer resolved the call. The ledger exists so an organization can see what its people and agents did; it is visible to that organization, and it is not shared with other customers.
Do not put a secret in a tool argument that is not meant to be a credential. Arguments are recorded, and while we filter obviously secret-shaped values out of some views, that filtering is a convenience and not a control you should rely on.
The Claude Code plugin
The plugin is different by design. It installs local hooks that observe tool
calls in your Claude Code session — Bash, Edit, Write, Read, Glob,
Grep, WebFetch, Agent, and MCP tool calls — and checks them against
your organization's governance policy.
Raw tool input never leaves your machine. For each observed call the plugin sends only two derived values:
| Sent | What it is |
|---|---|
| A content digest | A SHA-256 hash of the tool's input. It identifies repeat calls; it does not carry the input |
| A short summary | Deliberately lossy, and different per tool: Bash sends the first token of the command; Edit and Write send a path relative to your working directory; WebFetch sends the domain only, never the full URL; every other tool sends its name alone |
So we learn that you ran a command, and roughly what kind — not the command. We learn that you edited a file, and where in your project — not its contents. That is still a record of your local activity, and you should install the plugin understanding that. It is not a record of your work.
By default the plugin is audit-only: it reports, and blocks nothing. An organization can turn on enforcement explicitly.
Tool calls the plugin makes to NobleCloak's own services are governed at our gateway instead, and follow the connector rules above rather than these.
What neither one does
Neither is used to train AI models — see the trains_on_data_by_default
claim on the Overview page for the underlying commitment and its
citation. Neither is sold, and neither is shared with third parties for
their own advertising purposes.
Retention of these records follows the Retention section below: we have not yet published a fixed schedule, and this data is not an exception to that.
Legal bases
Where a legal basis is required, we rely on one or more of: performance of a contract with you or your organization, our legitimate business interests in operating and securing the service, compliance with a legal obligation, and consent where the law requires it.
Retention
We retain personal information for as long as needed to provide the service and to satisfy legitimate business, accounting, or legal obligations, and delete or anonymize it after that. We have not yet published a fixed retention schedule; when we do, it will appear here and on the Overview page.
Subprocessors
Vendors that process personal information on our behalf, and what each one can reach, are listed on the Subprocessors page.
Your rights
Depending on where you live, you may have the right to request access to, correction of, or deletion of your personal information, to object to or restrict certain processing, and to receive a copy of your data in a portable format. To exercise any of these rights, email privacy@noblecloak.com from the address associated with your account (or otherwise identify yourself) and describe the request; we will verify your identity before acting on it.
Contact
Last updated: 2026-08-13