# Aikido Security - Enterprise Compatibility Evaluation

## Tool Overview
**Name:** Aikido Security
**Website:** https://aikido.dev
**Category:** AI-Powered Security Platform (Pentesting, Code/Cloud Security)
**Date Evaluated:** 2026-02-02

---

## Privacy & Enterprise Use

### Commercial/Enterprise Use Permission
**Status:** ✅ APPROVED FOR ENTERPRISE USE

**Key Findings:**
- Positions as "developer-first" security tool
- Well-funded startup (recent funding rounds)
- Enterprise-focused features available
- Designed for commercial use with SaaS and on-prem options

### Model Training on User Data
**Status:** ✅ LIKELY SAFE (NO PUBLIC INDICATION OF TRAINING)

**Key Findings:**
- **No public statements indicating customer code used for training**
- GDPR compliant by design (EU regulations require disclosure)
- Trust Center emphasizes privacy
- Based on industry standards: AI likely trained on public vulnerability data, NOT private customer code

**Data Processing:**
- Scans source code and cloud configurations
- Uses AI-driven pentesting and simulation
- Static analysis and AI agent testing
- Results stored securely per customer account

**GDPR Compliance:**
- Any use of customer data for training MUST be disclosed under GDPR
- Absence of such disclosure suggests no training usage
- Privacy Officer listed for concerns
- Data protection by design philosophy

### Data Retention Policies
**Status:** ⚠️ NOT PUBLICLY SPECIFIED

**Key Findings:**
- Retention period not publicly disclosed
- Enterprise customers can likely negotiate terms
- Scan results and findings stored for dashboard access
- Likely follows industry standard retention (6-12 months)

### Data Sharing Practices
**Status:** ✅ NO EXTERNAL SHARING (ASSUMED)

**Third-Party Sharing:**
- Customer data segregated per account
- No indication of external sharing
- GDPR compliance requires strict data handling
- Privacy Policy states they don't sell data
- Data shared only with third parties needed to deliver services

**Infrastructure:**
- Multi-region hosting available
- On-premise options for sensitive organizations
- Private cloud deployments possible

### IP & Confidentiality Concerns
**Status:** ✅ STRONG PROTECTIONS (ASSUMED)

**Intellectual Property:**
- You own your code and vulnerability findings
- Aikido provides scanning and pentest results
- No IP claims on customer code
- Reports and findings belong to customer

**Confidentiality:**
- GDPR-centric privacy approach
- SOC 2 compliance likely in progress (newer company)
- Designed for enterprise pentesting (inherently sensitive)

---

## Pricing & Plans

### Pricing Model
**Structure:** Tiered subscription (public pricing not fully disclosed)

**Known Tiers:**
- **Free:** For students and open-source projects
- **Paid Plans:** Per-app or platform subscription
- **Enterprise:** Custom pricing with advanced features

### Features
**Free Tier:**
- Students get Aikido free
- Open-source project support

**Enterprise Features:**
- AI-powered pentesting agents
- Code and cloud security scanning
- Continuous monitoring
- Integration with CI/CD
- SSO and role-based access

### Usage Limits
- Free tier: Limited scans/apps
- Paid tiers: Based on number of apps or scan frequency
- Enterprise: Likely unlimited or high limits

---

## Enterprise Compatibility Assessment

### Strengths ✅
- **GDPR compliant by design** (privacy-first approach)
- **No indication of training on customer code**
- AI pentesting with developer-friendly UX
- Privacy Officer available for concerns
- On-premise deployment options
- Multi-region hosting
- Modern, well-funded platform

### Concerns ⚠️
- **Newer company** - less track record than established players
- **Limited public documentation** on data handling specifics
- SOC 2 compliance status unclear (likely in progress)
- Retention policies not transparent
- **Requires verification** of privacy claims

### Recommendations

**✅ PROVISIONALLY APPROVED WITH VERIFICATION**

**Action Required BEFORE Use:**
1. **Request written confirmation:** No customer code used for training
2. **Verify SOC 2 status:** Check current compliance certifications
3. **Clarify data retention:** Get specific retention policies in writing
4. **Review DPA:** Ensure Data Processing Agreement covers all concerns
5. **Consider on-prem:** For highly sensitive codebases

**Best For:**
- Organizations wanting modern AI-powered security testing
- Teams using continuous pentesting
- Companies comfortable with newer vendors (after verification)
- Cloud-native applications

**Not Ideal For (without verification):**
- Highly regulated industries requiring established vendors
- Organizations with strict "proven track record" requirements
- Companies unable to get written privacy guarantees

**For Hack Days:**
- ⚠️ **Use with caution** - requires connecting to code repository
- Should get written confirmation of privacy policies first
- Consider using on non-sensitive code first
- Alternative: Use established tools (Snyk) if time-constrained

### Comparison to Alternatives
- **Snyk:** More established, explicit "no training" policy, broader adoption
- **Escape AI:** Similar AI pentesting, also newer company
- **Traditional SAST/DAST:** More established but less AI-native

---

## Sources & References

1. **ChatGPT Evaluation Report** - Aikido Security analysis
2. **Aikido Website**: https://aikido.dev
3. **Trust Center**: Mentioned GDPR compliance
4. **Privacy Policy**: States no data selling, GDPR focused

---

## Notes
- Last Updated: 2026-02-02
- Evaluator: Claude Code based on ChatGPT findings
- **Key Finding:** Aikido appears safe based on GDPR compliance and lack of training disclosures, but requires verification due to limited public documentation
- **Status:** Newer player with strong privacy stance, but needs written confirmation before enterprise use

---

## ⚠️ VERIFICATION CHECKLIST

Before using Aikido Security, obtain written confirmation of:
- [ ] No customer code used for AI model training
- [ ] Specific data retention periods
- [ ] SOC 2 Type II certification status
- [ ] Data Processing Agreement (DPA) terms
- [ ] On-premise deployment options (if needed)
- [ ] Incident response and breach notification procedures

**Recommendation:** For hack days, use established tools (Snyk) unless Aikido verification can be completed quickly. For production use, complete full verification process.