Security
Your code stays yours.
How we reach your code, how long we keep data, which models see it, and where it runs.
How access works
On GitHub, swarmbase works through a GitHub App that you install on the repositories you choose. It reads code, metadata and pull requests, and writes only check runs, to report results on pull requests.
On GitLab and Bitbucket, sign-in asks for read access. Turning on auto-scan asks once more for what a webhook needs: GitLab's api scope or Bitbucket's Webhooks permission.
We never change your code.
Provider tokens are encrypted before they are stored, under a key held in Google Cloud KMS and rotated every 90 days. GitHub installation tokens are created when needed and never stored.
Sessions use HttpOnly cookies. Refresh tokens are stored only as hashes and change on every use.
Data lifecycle
Scanners and agents read a snapshot of your repository. Snapshots are deleted within 48 hours.
Fixed, ignored and false-positive findings are deleted after your plan's retention period (90 days on Free, 365 days on Pro, 365 days on Team). Pull request findings go 30 days after the pull request's last scan.
Archiving a repository stops scanning at once; it is deleted with its findings 30 days later. Deleting your account revokes your sessions and provider tokens at once and removes your user record after 30 days.
AI processing
AI explanations and swarm runs send the code they need to Anthropic's Claude models through Anthropic's API.
Anthropic's Commercial Terms do not let it train models on content sent through its API. Anthropic deletes that content within 30 days, unless it is flagged under its Usage Policy (kept for up to 2 years) or the law requires it to be kept longer.
We don't train models on your code.
Your code reaches the models marked as untrusted content, never as instructions, and agents only read your repository.
Infrastructure
swarmbase runs on Google Cloud in us-central1 (Iowa, United States), with its PostgreSQL database on Aiven and its Redis cache on Upstash in the same region.
Connections to swarmbase use TLS 1.2 or later.
Data at rest is encrypted by the platforms that hold it: Google Cloud, Aiven and Upstash.