What we store, and what we never store
Findings, facts, paths and masked evidence. Not your source, not your secrets, not your users’ data.
Kept
- Findings
- What a rule raised, where, and the masked evidence behind it.
- Facts
- What we learned about the application, with confidence and provenance.
- Paths and line references
- Enough to take you to the problem in your editor.
- Short snippets
- A few lines of context around a finding, with secrets masked out.
- Scan metadata
- Timings, coverage, outcomes and the audit trail.
Never kept
- Your repository
- Source is fetched for analysis and discarded. We are not a mirror.
- Full credential values
- Masked at detection, before storage, and never sent to a model.
- Your users’ data
- A probe proves data is readable; it does not collect what it reads.
- Training data
- Nothing you connect trains a model, ours or anyone else’s.
Questions
Where is data hosted?
On managed infrastructure in the EU, encrypted in transit and at rest. Ask us if you need the specifics for a questionnaire.
Can I delete everything?
Yes. Deleting an organization takes its sites, scans, findings, reports and facts with it. Ask support if you want an export first.
Do subprocessors see my data?
The model provider sees what a task sends it - a finding, a summary of facts, or the file being fixed - and never a raw secret. Email, payments and hosting are the other subprocessors; we will send the list on request.
Something here wrong, missing or out of date? Tell us and we will fix the page.