Your data, and how we handle it
- Read-only by design. When you connect a repository, an endpoint, or usage data, our access is read-only. We never write to your code, systems, or accounts.
- We never store your secrets. API keys and credentials are used only in the moment to run the scan, and are never saved to our database.
- What we analyze. We process only the code, configuration, and usage data you connect, and only to produce your grade and report.
- Encrypted. Your data is encrypted in transit and at rest.
- Retention and deletion. We keep submissions for 30 days, then delete them. You can request deletion at any time, and a “don't retain my code” option is available for sensitive submissions.
- Never used to train without your opt-in. We never use your private data to train or improve anything unless you explicitly choose to let us.
- GDPR. We handle personal data in line with the GDPR. A Data Processing Agreement (DPA) is available on request.
Questions or a data request: [email protected]