Trust Center

What we do with your data, and what we can see

A discovery tool asks for access to the most sensitive thing you own. This page states plainly what it reads, what it keeps, and what it deliberately cannot reach.

What we can see, and what we cannot

Item	Hosted scan	Offline scanner
Source code	Fetched and processed in memory. Reports retain findings, file paths and source excerpts.	Stays on the machine unless you upload a report, which includes source excerpts.
File contents	Matched and, on eligible plans, parsed within scan budgets. Matched source excerpts are retained in reports.	Read locally. Report uploads include matched source excerpts.
Secrets and private keys	Evidence text is redacted for files with detected sensitive material. Detection can miss secrets; review reports before sharing.	Same, locally.
Business data	Never read. No database is ever connected to.	Never read.
Cloud credentials	Not requested.	Uses the CLI credentials you already have, on your machine. We never receive them.
Endpoint traffic	We make an ordinary TLS connection to the host you name, and read what it negotiates. We do not capture or decrypt any other traffic.	Same, from your network.

Encryption in transit and at rest

Everything is served over TLS. Stored reports sit in encrypted storage, and repository access tokens are sealed with AES-GCM under a key held only by the deployment. If that key is absent, the service refuses to store a token at all rather than storing one it cannot protect.

Retention

Anonymous scans are kept for 24 hours. Signed-in public repository scans follow the plan retention: one day on Free, one year on Team, three years on Enterprise. Other scan routes may have different retention. Contact us for deletion; there is no self-service report deletion yet.

Scanner permissions

The scanner reads repositories. GitHub linking currently requests the broad OAuth repo scope, which grants read and write access beyond the repositories you select here. GitLab requests read_api and read_repository. Review the provider consent screen. The offline scanner runs with your local permissions.

What leaves the offline scanner

Activation and allowance checks contact the service. Scan reports are uploaded only when you choose to send them. The upload preview describes: the target, the score, the algorithms and the findings. Reports include file paths and matched source excerpts. Evidence from files with detected sensitive material is redacted, but review the report before upload.

Subprocessors

Cloudflare for hosting, storage and bot protection. Stripe for payments, once billing is enabled. No analytics, advertising or third party tracking scripts run on this site.

Reporting a vulnerability

Tell us before you tell anyone else, and we will not pursue you for testing this service in good faith. We will acknowledge within two working days, keep you updated, and credit you unless you prefer otherwise.

Evidence you can check rather than trust

Detection accuracy: precision, recall and evidence placement against a fixed corpus with hand written answers, measured on every release, plus live totals from real scans.
What we detect: the rule set, generated from the engine itself so the published list cannot drift from the software.
Methodology: how classification and scoring work, and where the method stops.
Verification on every release. The accuracy corpus is measured and the build fails if precision or recall drops below the published floor. The two scanners are compared over shared fixtures. Hosted budgets and plan-dependent parsing can produce different results on larger repositories. The deploy asks the deployed scanner to read a syntax tree, and the release fails if it cannot.
Privacy notice and terms.

What we are not

We are not affiliated with, endorsed by, or acting on behalf of CSA, GovTech, IMDA or MAS. We do not administer or reproduce the official Quantum Readiness Index, and a scan does not make anyone compliant. No certification has been claimed that we do not hold.