Privacy policy

NCode is the controller of the personal data described here. Reach us at privacy@appscan.sh.

Account data. Your email address, a hashed password, your organisation name, and the roles of people you invite. We never store a password we could read.

What you connect. The domains you verify and the repositories you connect through the GitHub App, plus the access tokens needed to read them, which are encrypted at rest.

Scan results. Findings, the masked evidence behind them, file paths and line references, short code snippets for context, and what we have learned about the application’s structure.

Operational data. Request logs, audit records of who did what in your organisation, and usage counters for billing.

Billing data. Which plan you are on, what you were charged, and an identifier from the payment provider. We never see or store your card number.

Your source code is fetched for analysis and discarded afterwards. We are not a mirror and we do not retain repositories.

Secrets that a scan detects are masked before they are written down. We record that a secret of a given kind exists at a given place; we do not keep its value.

Card numbers, CVVs and bank details never reach our servers. They are handled entirely by the payment provider.

We process account, scan and operational data to perform our contract with you. We process billing data to comply with tax and accounting law. Where we rely on a legitimate interest - keeping the service secure and preventing abuse - you can object, and we will stop unless we have compelling grounds not to.

Paddle.com Market Ltd and our other payment providers, to take payment and issue invoices. They are the controller of the payment data you give them.

GitHub, when you connect a repository, to the extent the GitHub App you installed allows.

Anthropic, where you have opted into AI-assisted analysis. Only the code and finding context needed for that specific task is sent, and it is not used to train models.

Infrastructure and email providers that host the service and deliver its messages.

We do not sell personal data, and we do not share it for advertising.

Data is processed in the European Union and in other countries where our providers operate. Where data leaves the European Economic Area, it is covered by Standard Contractual Clauses or an equivalent safeguard.

Account data is kept while the account exists. Findings and reports are kept so your history survives a lapsed subscription - losing your security history because a card expired would be the wrong behaviour.

Logs and operational data are kept for a bounded period and then downsampled or deleted. Billing records are kept as long as tax law requires, which is longer than we would otherwise choose.

Delete your account and we remove your data within 30 days, except records we are legally required to retain.

You can ask for a copy of your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable form. Email privacy@appscan.sh and we will respond within 30 days.

If you think we have handled your data wrongly, you may complain to your local data protection authority. We would rather you told us first.

We use the cookies and local storage needed to keep you signed in and to remember interface choices such as the site you last worked on. We do not use advertising or cross-site tracking cookies.

Passwords are hashed, tokens and secrets are encrypted at rest, access is scoped per organisation, and every privileged action is audited. The Security page describes this in detail, including what a scan is allowed to do.

The service is for businesses and is not directed at anyone under 18.

We will post any change here and update the date at the top. Where a change materially affects how we use your data, we will tell you before it takes effect.