Chengming Technology Issues Letter Holding Zhipu ZCode Accountable for 'Unauthorized Upload of Company Data,' Questions 'Issue Resolved' Statement Taiyuan Chengming Technology Co., Ltd. has issued a letter to Beijing Zhipu Huazhang Technology Co., Ltd., raising multiple demands regarding the alleged unauthorized upload of company data assets and trade secrets by its ZCode client. Chengming Technology has also reserved the right to pursue legal action. Chengming pointed out that although Zhipu publicly apologized for the 'silent upload of users' local repository data' via ZCode and claimed the issue had been resolved, independent evidence collected by Chengming revealed that the uploads were automatically triggered and occurred in batches. These uploads included not just 'code snippets' but also complete project source codes, system architectures, version control histories, database passwords, cloud service credentials, and employees' personal information—far exceeding the data collection scope outlined in Zhipu's Privacy Policy. Additionally, while the ZCode client was updated to version 3.12.3 on September 16, Chengming detected upload activity on the same day Zhipu issued its public apology, raising doubts about the effectiveness of the so-called 'fix.' Furthermore, the network requests from the ZCode client were directed to an entity in Singapore, while the service agreement was signed with Beijing Zhipu Huazhang, prompting Chengming to demand clarification on the responsible entity for the uploads and whether the data was transmitted or stored overseas. Chengming Technology has requested Zhipu to provide a written response by October 10 and complete the following actions: - Immediately cease processing and thoroughly delete all uploaded data, including related derivative data, caches, and backups. - Provide a comprehensive list detailing the handling of the data. - Clarify the data's destination, whether it was shared with third parties, used for model training, or transmitted across borders. - Explain the storage method of encryption keys and provide a complete operation log of data access, downloads, and exports. - Specify the exact scope of 'destruction' mentioned in previous public responses. - Issue proof of data deletion. - Provide a written commitment to cease unauthorized uploads. - Legally provide access, copies, and explanations of personal information. - Designate an official contact channel. - Clarify the responsible entity and the status of cross-border data transfers. - Provide the original text of the published rectification statement. As of now, Zhipu has not publicly responded to the letter. #DataPrivacy #TechNews #ZCode #ChengmingTechnology #ZhipuHuazhang #CyberSecurity #DataBreach