HeimWall

This is an early version, not a finished enterprise control plane. The team product is labeled early access. The Individual page still says v0.0.5 and 3.9 MB, while the download API pointed to v0.0.6 and the publisher screenshot also shows v0.0.6. No public changelog, installer SHA-256, reproducible build, or source code was found to map the binary. Feature definitions drift as well: the maker's Uneed copy says 47 hand-written rules while the current site says 25+; Individual says a pretrained classifier runs locally while the architecture labels it 'architecture shipped · model pending'; FAQ says 'no browser extension, no proxy' while Home and How it works include a local TLS proxy; and pages plus screenshots differ on coverage for Cursor, Claude Code, Copilot, Windsurf, and ChatGPT. The privacy boundary needs precision. Individual claims no account, backend, or network. Team mode may upload tool, category, severity, rule, timestamp, a redacted snippet up to 500 characters, and a correlatable hash. Privacy names Investigation Mode as the sole exception to no raw-prompt upload and retains investigation records for a contractual legal-hold period, while the architecture says the server stores an unreadable sealed payload. Public material does not explain whether that payload contains raw prompt text, when it is produced on the endpoint, who holds decryption keys, whether an employee can refuse or revoke it, what happens if notice fails, or the guessing risk of deterministic hashes over low-entropy secrets. Team events are queryable for 90 days, cold-stored for another 180, then retained as org aggregates. A public subprocessor page is still in preparation; the draft Privacy page names Supabase, ClickHouse Cloud, Clerk, Vercel, Fly.io, Resend, and Anthropic. The public site bundle also includes a PostHog page-view provider configured with memory persistence and session recording/autocapture disabled, while the current Privacy draft does not separately explain website analytics. Compliance and contracts are incomplete: Privacy and Terms are both April 22, 2026 drafts, and the binding terms and MSA are still being prepared with counsel. FAQ says SOC 2 Type II is in progress and HIPAA eligibility arrives with a future v1.5, while Pricing directly lists an Enterprise SOC 2 report, HIPAA eligibility, BYOK, and on-prem and also marks some items 'soon' in its comparison table. GDPR, signing/notarization, <50ms p95, 95% soft notifications, 99.9% SLA, the blog's three teams / 312 engineers, and enforcement of the no-performance-review covenant are team statements. No audit report, corpus, false-positive/negative results, notarization ticket, customer reference, or final contract was independently checked. Team and Business are annual per-seat subscriptions, and FAQ describes a $15K deposit for a 30-day paid POC. Before production procurement, confirm the available version, seat minimums, refunds, legal entity and address, lawful basis for employee monitoring, DPA, regions, subprocessors, keys, and deletion flow.