Privacy

Your account: name, email address and the identifiers of the GitHub, GitLab or Bitbucket accounts you sign in with. Your work: the repositories you connect, their scan results and your triage decisions. Billing details go to Stripe; we keep the plan, invoices and credit usage.

Your code is read from a short-lived snapshot to scan it, and the parts an AI feature needs are sent to the AI provider. We don't train models on it.

This site sets no cookies. If analytics is enabled, it counts page views and clicks on the sign-in buttons, without cookies or identifiers, and not at all when your browser sends Do Not Track or Global Privacy Control. The app itself uses only the cookies it needs to keep you signed in.

We use these processors:

• Google Cloud: Hosting, storage, queues and key management, in us-central1
• Aiven: The PostgreSQL database
• Upstash: The Redis cache
• Anthropic: AI explanations, fixes and swarm runs
• Stripe: Payments and invoices
• Vercel: Hosting of this website and the app's pages
• GitHub, GitLab, Bitbucket: Sign-in and access to the repositories you choose

Organizations that need a data processing agreement can ask for one.

Snapshots are short-lived, closed findings follow your plan's retention period, and deleted accounts and archived repositories are removed after 30 days. The details are on the security page.

Under the GDPR and India's Digital Personal Data Protection Act you can ask to see, correct or delete your personal data, object to its use, and take it with you. You can download your data and delete your account at any time from Settings, Profile; owners export and delete an organization from Settings, Organization.