Privacy and data retention

Server processing

Uploaded or pasted configuration JSON is sent to our server for static analysis. Scanning does not happen solely in your browser. Submit a sanitized copy under 50 KB, replacing credentials with placeholders. Sanitizing can change secret-detection findings.

The raw configuration is not stored as a complete input file. New stored results use positional labels such as Server 1, following configuration order, and trusted finding templates. Submitted server names, paths, command text, and code excerpts are omitted. Historical reports stored before this change may contain configuration excerpts or identifying values until they expire; previously downloaded or emailed copies may also retain them. Sanitization is not a reason to upload secrets: the submitted config still reaches our server. Replace credentials before uploading.

Scan links grant access

Scan URLs are bearer links: anyone with the link can access the results without signing in. After payment, that same link grants access to the full report and PDF. Payment unlocks the report for the link, not a private account. Share only with intended recipients and keep the URL out of public posts.

Retention

• Stored scan results and report access last seven days from scanning or starting checkout. Starting checkout refreshes that period.
• A prepared report-email retry payload is retained for up to 24 hours.
• Payment and email fulfillment metadata is retained for up to 30 days, without raw credentials.
• Waitlist email addresses are currently retained until removal.

These periods describe application storage. Downloaded PDFs, recipient email copies, and providers' own records may remain beyond them.

Checkout and report email

Stripe processes checkout. The checkout email address is used to send the report through Resend. Hosting and storage providers process scan data to run the service. An email status of “accepted” means the email provider accepted the request; it does not confirm inbox delivery. Paid users can download the PDF while the report is retained.