Data Handling and Privacy
0DIN Red is in beta. Data handling details may change as the product matures.
The short version
- 0DIN Red starts with no back-end access to your system. It is not connected to your databases, analytics, log pipelines, or model provider, and installs nothing. Depending on your application's vulnerabilities, it may gain back-end access during a run.
- It starts with what its test account can see, plus what you type into the assessment setup.
- It tests the way an attacker would. If it finds a way to escalate privileges or cross a tenant or role boundary, it will see whatever that access exposes, which can be more than the test account was meant to see.
- That means your users' prompts, conversations, or logs may be reviewed during an assessment if any path to them exists. Finding those paths is the point of the test.
- This is why we strongly prefer test or staging environments with test accounts and no real user data.
What 0DIN Red may see
| Data | May 0DIN Red see it? | Notes |
|---|---|---|
| Pages and responses shown to the test account | Yes | This is what 0DIN Red tests. It is kept as evidence for findings |
| 0DIN Red's own attack inputs | Yes | Written by 0DIN Red, sent to your product as the test account |
| Your users' prompts, conversations, and history | Possibly | If the test account can view them, or if 0DIN Red finds a way to reach them, such as another user's chat history, a shared conversation, or an admin view |
| Logs, support tools, admin dashboards | Possibly | Only if the product exposes them to the test account or 0DIN Red escalates into them |
| Your databases, telemetry, network traffic, back-end systems | Possibly | 0DIN Red starts with no access to them, but may reach them if it finds a vulnerability that exposes them |
| The test account's password (browser sign-in) | No | A person on your team signs in. 0DIN Red keeps the resulting browser session, not the password |
| A bearer token, API key, or Basic auth password set on the connection | Yes | Placed in the agent's briefing in plaintext, so it reaches the model provider |
| The session (cookies) from that sign-in | Yes | Stored for your organization and used only for runs against that target. Revoke it any time by signing the test account out or disabling it |
| Your assessment answers, asset map, and earlier findings | Yes | Built into the agent's briefing when a run starts |
What leaves your environment, and where it goes
During an assessment, everything your product returns to 0DIN Red leaves your system: pages, API responses, AI replies, and any data 0DIN Red reaches by escalating access. This goes to two places:
- 0DIN's infrastructure (Mozilla, Google Cloud). Stored per organization, isolated from other customers, and used to build your findings and report. The agent service also keeps a record of each run, including the briefing, the sign-in, and the pages it saw, until 0DIN deletes it. That copy has no per-organization isolation of its own, and deleting in 0DIN Red does not remove it.
- The AI model that drives the agent. The agent decides what to do next by sending what it has seen to a large language model hosted by a third-party provider.
Because of the second point, anything 0DIN Red sees may be processed by a third-party model provider.
If real users' prompts, conversations, or logs exist anywhere 0DIN Red could reach them, through the test account's normal access or through a vulnerability it finds, assume they may be read. The only reliable way to keep them out of an assessment is to test an environment where they don't exist.
Recommended setup
If your product has a rule that user prompts or data must not leave your system, use this setup:
- Test staging or a test environment, not production. It should hold no real user data. Seeded or synthetic data is fine and makes data-exposure findings easier to read.
- Create dedicated test accounts. Limited permissions are enough. Do not use a real person's account.
- Do not copy production data into staging for the test window.
- List no-go areas in the assessment's "Is there anything 0DIN Red must not do or touch?" field.
- Disable or revoke the test accounts after the engagement.
Every finding found on staging applies to production as long as the two run the same code, so testing staging loses little.
Questions
Contact 0DIN@mozilla.com for the egress IP or data retention details for your engagement.