This page lists every kind of data we touch, why we touch it, and how long it exists. If a data point is not on this page, we do not collect it.
When you visit this website
- No Google Analytics, no advertising trackers, no cross-site cookies.
- If we measure site usage, it is with cookieless, EU-hosted analytics that stores aggregates, not profiles.
- Waitlist signup: your email address, plus your answer to the optional question about your last rejection if you give one. Kept until launch communication is done or you unsubscribe, whichever comes first.
- Contact form: name, work email, company, subject, apps count and your message. Kept as long as the conversation is live.
When you scan a build
- The binary you upload: processed in an isolated environment, destroyed the moment the scan finishes. Never kept, never reused, never used to train anything.
- Findings and evidence: kept encrypted for your plan's retention window so you can compare releases; deleted when the window ends or when you delete them.
- Scan metadata (timestamps, rule versions, verdicts): kept with the findings, because a finding without its context is not evidence.
When you have an account
- Account data: email, name, team members and their roles.
- Audit log: who did what and when inside your workspace, kept for your plan's retention window.
- Billing: handled by Stripe; we never see or store your card details.
Where everything lives
EU infrastructure, EU vendors, with Stripe as the single named exception for payments. The vendor list and the full build lifecycle are on the EU-first data handling page, and we announce changes to that list before they take effect.
Your data is yours
- Findings, reports and evidence belong to you; export them at any time as PDF, SARIF or SBOM.
- Deletion means deletion: when you delete data or your account, it is removed from production immediately and from encrypted backups on their rotation schedule.
- We never sell data, never share it with advertisers, and never use your builds or findings to train AI models, ours or anyone's.