Privacy

1. Static analysis runs on your machine. In local mode your code never leaves it; only rule IDs, severities and counts are sent when an API key is configured.
2. The remote endpoint analyses submitted code in memory to answer the request and does not store it.
3. Customer code is never used to train models.
4. Reports redact secret values. Team posture is counts and categories only.
5. History (rule IDs, counts, timestamps) is kept 12 months and deleted with the account.

What we store about your account

Email address, a hash of your API key (the key itself is shown once), plan and Stripe customer ID, daily tool-call counts, lab progress, and the history in rule 5. The history table has no column that can hold code. Payments are handled by Stripe; we never see card numbers.

The scanner

The open-source scanner sends nothing anywhere unless you configure an API key. It never modifies your config files.

Deleting your account

Email the address on the security page from your account email and everything above is deleted.