Snyk

Snyk explicitly states it will NOT use Inputs to train AI Models. Section 5.4 of the ToS clearly states: 'Snyk will not use (or permit any of its Affiliates, sub-processors, or other third parties to use) any Inputs to train, enhance or improve any AI Models incorporated within the Services.' This protection applies to all tiers including free versions.

“[ToS] 'Snyk will not use (or permit any of its Affiliates, sub-processors, or other third parties to use) any Inputs to train, enhance or improve any AI Models incorporated within the Services.'”

The ToS grants Snyk only a limited license necessary to perform the Services. Section 5.2 confirms the customer retains exclusive ownership of all Outputs. Section 5.3 restricts Snyk's rights to those 'necessary to enable Snyk to perform the Services and otherwise exercise its rights and obligations hereunder.' The license is service-delivery-specific with no sublicensing beyond essential service provision.

“[ToS] 'You are and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, Code Assets and Outputs, including all Intellectual Property Rights relating thereto, subject to the rights and permissions granted in Section 5.3.'”

Snyk maintains a published sub-processor list and requires 30-day notice before adding sub-processors with customer objection rights (DPA Section 3.2). Sub-processors must be bound by materially equivalent DPA obligations (DPA Section 3.3). The DPA explicitly states Snyk will not sell Personal Data under CCPA (Section 7.5). No advertising or marketing partners receive user content.

“[DPA] 'Snyk shall maintain an up-to-date list of Sub-processors at https://snyk.io/policies/subprocessors/. Snyk will provide Customer with thirty (30) day notice prior to adding or replacing any Sub-processor' and '[DPA] 'Snyk shall not sell the Personal Data within the meaning of the CCPA.'”

While the DPA Schedule 1 states retention is 'As set forth in the Agreement,' the ToS does not specify explicit retention periods or automatic deletion timelines. Section 10.3(b) requires customers to 'promptly delete' their organization and projects, but Snyk's own deletion timeline is not clearly defined. The Privacy Policy states data is kept 'for as long as reasonably necessary' which is vague. Backup retention and data lifecycle are not documented.

“[DPA Schedule 1] 'The period for which the personal data will be retained, or, if that is not possible, the criteria used to determine that period: As set forth in the Agreement.' [Privacy] 'We keep personal information for as long as reasonably necessary to fulfill the purposes for which we collected.'”

Section 5.2 of the ToS explicitly states the customer 'are and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, Code Assets and Outputs, including all Intellectual Property Rights relating thereto.' Snyk claims no ownership or license rights to Outputs generated by the service.

“[ToS] 'As between the parties, you are and will remain the sole and exclusive owner of all right, title, and interest in and to all Customer Data, Code Assets and Outputs, including all Intellectual Property Rights relating thereto.'”

The ToS references a Security Addendum (Section 4.3) and the DPA incorporates EU SCCs, UK SCCs, and Swiss SCCs for GDPR/UK GDPR/FADP compliance. However, no specific certifications (SOC 2 Type II, ISO 27001, HIPAA) are explicitly mentioned in the provided documents. The Privacy Policy confirms GDPR compliance but formal certification status is not stated.

“[ToS] 'Snyk will employ security measures designed to protect Customer Data in accordance with the Snyk Information Security Addendum displayed at https://snyk.io/policies/snyk-security-addendum/.' [DPA] 'The parties agree that the terms of the EU SCCs Module Two (Controller to Processor) apply to any Restricted Transfer under GDPR.'”