Crucible

Privacy Policy

How BMC Operations LLC handles personal data in connection with Crucible and this website.

The short version: Crucible runs on your infrastructure. Campaign transcripts, findings, canaries and evidence ledgers stay on your systems and are never transmitted to us. This policy therefore covers very little — mostly the website and anything you send us by email.

1. Who we are

BMC Operations LLC, a Limited Liability Company organised in Delaware, United States, is the controller for the limited personal data described here. Contact: privacy@crucible.langes.fun.

2. What we collect

Information you send us

If you email us, we process your address and whatever you include. We keep correspondence only as long as needed to handle the matter and to maintain a record of security reports.

Website usage

Our hosting provider processes standard server logs, including IP address, user agent and requested path, to deliver the site and protect it from abuse. We do not operate advertising or cross-site tracking, and we do not sell personal data.

What we do not collect

  • Campaign transcripts, findings or evidence ledgers from self-hosted use.
  • Your canary values, system prompts or target endpoints.
  • API keys you configure. Those stay in your environment and are used directly against your providers.

3. Personal data inside your campaigns

If you test an agent that handles real personal data, your campaign may cause that data to appear in a transcript. You are the controller for it; we never receive it.

We strongly recommend synthetic canary records instead of real data. Crucible is designed so a synthetic record provides stronger evidence than a real one, specifically so that you never need to put a real person’s data into an adversarial test.

4. Legal bases (UK/EU)

  • Legitimate interests — operating and securing the website, responding to correspondence.
  • Consent — where you opt in to something specific, withdrawable at any time.
  • Legal obligation — where retention is required by law.

5. Sharing

We share personal data only with infrastructure providers that host this site and our email, and where required by law. We do not sell or rent personal data.

6. Retention

Server logs are kept for a short operational period. Correspondence is kept while the matter is live and for a reasonable period afterwards.

7. Your rights

Depending on where you live, you may have rights of access, correction, deletion, portability, restriction and objection. Email privacy@crucible.langes.fun and we will respond within the period the applicable law requires.

Note that we hold very little: for self-hosted campaigns, the data you are likely asking about is on your own systems, where we have no access.

8. International transfers

We are based in the United States and our providers may process data there. Where personal data is transferred from the UK or EEA, we rely on appropriate safeguards such as standard contractual clauses.

9. Children

Crucible is a developer tool and is not directed at children. We do not knowingly collect their data.

10. Changes

Material changes will be reflected in the date below.

Last updated 2026-10-07. These documents are published by BMC Operations LLC and are provided for transparency. They are not legal advice.