You're trusting us with sensitive code and the vulnerabilities we find in it. Here is exactly how we protect it, what we test, and how to report an issue — with an honest status of what's done versus in progress.
Each scan runs in an isolated, per-scan sandbox that's torn down on completion. We don't keep your source beyond the scan.
Model calls use Anthropic's commercial API, which under its terms is not used to train models. Standard requests are retained briefly for abuse monitoring, then deleted; zero-data-retention is available on enterprise agreement.
Every scan, finding, and target is scoped to your tenant; cross-tenant access returns not-found, never a data leak.
Run it in your own VPC with your own model key, so your code never leaves your environment.
Read live from this deployment, not a marketing page. Aligned to the OWASP LLM Top 10; every finding ships with a working proof-of-concept.
Coverage: … OWASP LLM Top 10 (2025) categories, each mapped to a MITRE ATLAS technique.
Every confirmed finding carries a reproduced exploit, not a CVSS guess — human-reviewable evidence.
A token-count watchdog kills any runaway scan at a ceiling you set, so an autonomous run can't blow your budget.
Per-tenant bearer tokens, constant-time comparison, and per-run ownership on every request.
Credentials and tenant state are never committed; the model API key is never returned by any endpoint.
| Provider | Purpose | Customer data? |
|---|---|---|
| Anthropic (or your model provider) | The LLM that drives the scan | Sent per scan; not retained/trained on |
| Container runtime (Docker) | The isolated scan sandbox | Ephemeral, torn down per scan |
| Cloud host (hosted only) | Compute + encrypted storage of findings | Encrypted at rest, per-tenant |
Self-hosted deployments have no MILLENNIUMS-operated sub-processors — you supply the model key.
Hosted deployments can be pinned to a region, including the EU. For strict residency or air-gap requirements, use the self-hosted / VPC option — data stays entirely within your environment.
We publish what's underway, not just what's finished.
The MILLENNIUMS.AI application and API. Please don't test other customers' tenants or data.
Email security@millenniums.ai with steps to reproduce. See our security.txt.
Good-faith research that follows this policy — no privacy violation, no data destruction, no service degradation — will not lead to legal action from us.
We aim to acknowledge reports within 3 business days and keep you updated through remediation.