Agent plugin · Privacy

ECZ-ID SBOM & CRA Readiness

Privacy

This notice describes how the ECZ-ID SBOM & CRA Readiness agent plugin — the package eczid-sbom-cra-readiness, version 0.1.1 — handles information. It covers that plugin only.

Everything below describes what the shipped code does, not what we intend it to do. The plugin is open source, and the review script is short enough to read in a few minutes.

Applies to:: eczid-sbom-cra-readiness 0.1.1
Effective date:: 3 September 2026

Summary

The review runs on your machine, on a folder you choose, only when you ask for it.
It reads file names and paths. It does not open, read, parse or transmit the contents of any file.
It makes no network request of any kind. This plugin ships no MCP server and contacts no host, including ours.
It writes nothing. There is no cache, no log file, no database and no report file unless you redirect the output yourself.
There is no telemetry, no analytics, no crash reporting and no usage counter. No account is required, and none is offered.
EcoCitizenz receives nothing from the plugin. We cannot see that you ran it, or what it found.
The agent host you run it in is a separate matter, governed by that platform's own terms — see your agent host.

Scope of this notice

This notice applies to the ECZ-ID SBOM & CRA Readiness agent plugin, published by EcoCitizenz as eczid-sbom-cra-readiness at version 0.1.1. The plugin consists of a manifest, one skill document and one review script.

It does not cover, and must not be read as covering:

the agent host or AI platform you run the plugin inside, which is operated by a third party under its own terms;
the free ECZ-ID SBOM & CRA Readiness extension for VS Code, which is a separate product with its own privacy notice;
other ECZ-ID plugins — in particular those that launch the ECZ-ID MCP Verifier, which does make network requests where a user asks it to check a public surface;
EcoCitizenz websites, TrustOps, the Resolver or any other EcoCitizenz service you may visit afterwards by following a link.

It supplements the EcoCitizenz Privacy Policy, which is the general policy for EcoCitizenz services and explains your rights and how to contact us about personal information. Where this notice describes the plugin's behaviour specifically, it is the more specific statement.

What the plugin reads

When you ask the agent to review a workspace, the bundled script walks the directory you named and builds a list of workspace-relative file paths. That list is the entire input to the review.

File names and paths, not contents

Detection is done by matching patterns against the path string — for example, a path ending in .spdx.json, or a file named SECURITY.md. The script does not call any file-reading function. It contains no code capable of opening a file, and it never sees the bytes of your SBOM, your lockfile, your source code, your .env file or anything else.

This is a genuine limit on the product as well as a privacy property: it is why the review reports that a document exists where a reviewer would expect one, and never claims the document is adequate.

What is skipped before anything is read

Hidden entries whose name begins with a dot are skipped entirely, with three exceptions that commonly hold the evidence being looked for:

.github
.gitlab
.well-known

These directories are never descended into, so build output and installed dependencies are not enumerated:

node_modules
.git
.pnpm-store
dist
out
build
.next
.turbo
.venv
venv
__pycache__
target
coverage

Traversal is also bounded: at most 8 directory levels below the folder you chose, and at most 20,000 files. A directory the script cannot read is skipped silently rather than retried.

What ends up in the result

The review output contains only:

the name of the folder you reviewed — its final path segment, not its full path;
for each evidence class that was observed, the workspace-relative path of the first matching file;
the Review Priority, the reasons for it, and the guidance text for each class;
the time the review ran.

That output is returned to the agent that asked for it, in the session you are already in. Nothing else is produced.

Network behaviour

The review makes no network request. The script imports two standard Node.js modules — the directory-listing and path-handling functions — and nothing else. It contains no HTTP client, no socket, no fetch call and no code that starts another process. You can confirm this by reading review.mjs, which has no dependencies and no build step, so the file you read is the file that runs.

Unlike some other ECZ-ID plugins, this one ships no MCP server. There is no background process, no long-running connection and no separate binary fetched at install time beyond the plugin package itself.

Links in the result. A review ends with at most three suggested next steps and one optional discovery link, chosen from a fixed list according to what was observed. These are ordinary web addresses printed as text. Nothing is requested unless you choose to open one, and no information about your workspace is appended to them: no query parameters, no identifiers, no tracking parameters. If you do open one, that is ordinary browsing, and the site you land on sees the request as it would any other.

Storage and retention

The plugin stores nothing. The script has no code that writes a file, creates a directory or opens a database. It keeps no cache, no history and no record of previous reviews.

The result exists as output in your agent session. If you want to keep it, you have to save it yourself — for example by redirecting the command output to a file. That copy is yours, in a location you chose, and this notice does not govern what you do with it.

Because nothing is transmitted and nothing is stored by us, there is no retention period, no archive, no backup and no server-side copy of anything the review observed. There is no plugin data for you to access, correct, export or delete, because none is collected or held.

What EcoCitizenz receives

Nothing. The plugin transmits no data to EcoCitizenz, so we do not receive and cannot hold:

your name, email address, account identifier or organisation;
the name, path or contents of any file in your workspace;
the results of any review, or the Review Priority it produced;
the fact that you installed the plugin, or that you ran it;
your IP address, machine identifier, operating system or agent host;
usage counts, timings, feature analytics or crash reports.

We therefore have no plugin data to sell, rent, share, transfer or disclose — including in response to a legal request. There are no advertising, tracking or data-broker integrations, because there is no data path to integrate.

The one way we learn anything is if you tell us: if you email support, we hold that message and whatever you chose to put in it. The Support page sets out what is useful to send and what should never be sent.

Secrets and credentials

The plugin never asks for a credential, has no field in which you could enter one, and needs none to run. It performs no authentication and holds no token.

Because it does not read file contents, it cannot read a secret value out of a .env file, a keystore or a configuration file. Files beginning with a dot — which is where credentials most often sit — are skipped before matching, apart from the three allow-listed directories above.

One consequence is worth stating plainly: an evidence class can be reported as OBSERVED together with the path of the matching file. A path is not a secret value, but a path can still be revealing in an unusual repository. You see that path before anyone else does, and you decide whether to share the result.

Your agent host is a separate matter

This is the distinction that matters most, and we would rather over-explain it than let it be assumed.

What this notice covers

The plugin: what it reads, what it computes, and what it sends — which, as set out above, is nothing.

What this notice does not cover

You run this plugin inside an agent host — a coding agent, an assistant, a CLI or an AI platform — operated by a third party. That platform decides what your conversation contains, what it transmits to its own servers, how long it retains it and what it does with it. That typically includes your prompts, the agent's replies, and the review output the agent shows you, since the output becomes part of the conversation.

EcoCitizenz has no control over, and no visibility into, that processing. We do not operate those platforms, we are not a party to your agreement with them, and we cannot make commitments on their behalf. Their handling of your data is governed by their own privacy policy and terms, which you should read if that matters to you.

The practical point: choosing a local-first, read-only plugin does not by itself make your session private. It means this plugin adds no data flow of its own to whatever your platform already does.

Children

The plugin is a developer tool. It is not directed at children and knowingly collects information from nobody, because it collects information from nobody at all.

Changes to this notice

If the plugin's handling of information changes, this page is updated before or alongside the release that changes it, and the effective date is revised. Where the plugin is distributed through a marketplace listing, the updated notice is the one linked from that listing.

The version this notice applies to is stated at the top of the page. If you are running an older version, read the notice published with it.

Contact

Questions about this notice, or about privacy in relation to this plugin, can be sent to support@ecocitizenz.com. The same address is the route for data-protection requests under the general EcoCitizenz Privacy Policy.

See also the Support and Terms pages for this plugin, and the source if you would rather check than be told.

What this notice does not claim

Local and read-only is a description of behaviour, not a security guarantee. We do not claim the plugin is secure in any absolute sense, and no statement here is a security or compliance certification.
The review does not certify, approve or guarantee any repository, product or organisation. EVIDENCE NOT OBSERVED does not mean unsafe or non-compliant, and EVIDENCE OBSERVED does not mean adequate.
We describe what the plugin does. We make no representation about what your agent host, operating system, editor or any other software on your machine does at the same time.

Publisher

ECZ-ID SBOM & CRA Readiness is published by EcoCitizenz Ltd, trading as EcoCitizenz, company number 17348848, registered in England and Wales.

66 Paul StreetLondon EC2A 4NAUnited KingdomContact: support@ecocitizenz.com