Article

【Chengming Technology Sends Letter Holding Zhipu Accountable for ZCode’s Alleged Unauthorized Upload of Data】

Taiyuan Chengming Technology Co., Ltd. sent a letter to Beijing Zhipu Huazhang Technology Co., Ltd., making multiple demands and reserving its right to pursue legal liability over allegations that its ZCode client uploaded the company’s data assets and trade secrets without authorization. Chengming Technology stated that although Zhipu publicly apologized for “ZCode silently uploading users’ local repository data” and said it had fixed the issue, independent evidence collection found that the uploads were automatically triggered and occurred in batches, including complete archive files containing full project source code, system architecture, version-control history, database passwords, cloud-service credentials, and employees’ personal information—far exceeding the scope of collection stated in its Privacy Policy. Although the client was September 16 updated to 3.12.3, upload activity was still detected in the early hours of the day Zhipu issued its public apology, raising questions about the actual effectiveness of the claimed fix. Meanwhile, ZCode client network requests point to a Singapore entity, whereas the service agreement’s contracting party is Beijing Zhipu Huazhang. Chengming Technology requested clarification of the entity responsible for these uploads and whether the data was transferred abroad or stored overseas. Chengming Technology requested that Zhipu provide a written response by October 10 and complete the following: immediately cease processing and permanently delete all uploaded data and related derived data, caches, and backups; provide a complete list of processing activities; explain the data’s destination, whether it was shared with third parties, whether it was used for model training, and whether cross-border transfers occurred; explain how encryption private keys are safeguarded and provide complete operation logs; clarify the precise scope of “destruction” stated in prior public responses; issue proof that deletion has been completed; provide a written undertaking not to upload data without authorization again; provide access, copies, and explanations regarding personal information in accordance with the law; and designate a formal liaison channel. Zhipu has not publicly responded to the letter to date.