Privacy Policy

Last updated: September 26, 2026

For infrastructure and subprocessors, see our Security & data handling page.

Overview

SystemAudit.dev ("we", "our", or "the Service") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your information when you use our codebase analysis service.

What Data We Collect

  • GitHub Repository URLs — The public or private repository links you submit for analysis.
  • Email Addresses — When you unlock full reports, join our product-updates list, or purchase an audit.
  • Payment Information — Processed securely by Stripe. We never see or store your card details.
  • Analysis Results — The generated reports and findings from your codebase scan.

How We Handle Your Code

Your source code is not stored.

We read the files we analyse through GitHub's official API, process them for the scan, and discard them. We do not keep a copy of your repository.

  • What a report keeps — File names, line numbers, metrics, dependency names, the findings, the AI-written analysis, and one-line excerpts of flagged code. Secret values in those excerpts are masked before anything is saved or shown.
  • Public repositories — Read with our own GitHub token, which can only read public repositories and cannot change anything.
  • Private repositories — Private repositories are read through the SystemAudit GitHub App. It asks GitHub for read-only access to repository contents and metadata, and only on the repositories you select when you install it; it cannot push code, open issues or change settings. Your GitHub sign-in token is stored encrypted, expires after eight hours and is refreshed only while you stay connected, and is revoked and deleted when you disconnect. You can change which repositories the app can read, or uninstall it, any time in your GitHub settings.
  • AI processing — Code sent for analysis goes to Anthropic's Claude models through Vercel's AI Gateway, with zero data retention and no training on your code required on every request.

The Claude Connector (MCP)

SystemAudit can be added to Claude as a connector (how to add it). When you ask Claude to scan a repository, Claude sends us the repository you named and nothing else.

  • What we receive — The repository URL or owner/name only. No other part of your conversation with Claude reaches us, and the connector requires no sign-in or account.
  • Public repositories only — The connector refuses anything it cannot read with our own public-repository token.
  • What we return — A health score, ranked findings, structure and counts of potential exposed credentials. The connector returns counts only, not credential locations or values; the full report it links to on systemaudit.dev shows locations for critical and high findings, as it does for any public repository scan.
  • What we keep — The resulting report, on the same terms as any other scan in this policy, so the link in the answer resolves. Our team may also be notified of a request: the repository named, which tool was used and whether it was answered. We keep no record of who asked.

How We Use Your Data

  • To perform codebase analysis and generate your audit report
  • To send you your report and any related communications
  • To process payments for paid audit tiers
  • To improve our service (aggregated, anonymized usage patterns only)

Recent Public Scans on the Homepage

Scans of public repositories may appear in the “Recent Public Scans” list on our homepage, in this rounded form only:

  • Never shown — The repository name, owner, URL, description, file paths, line numbers, credential values or a link to the report.
  • Shown — The main language, either the AI builder it was set up with when that tool left its files in the repository (for example Lovable or Cursor) or, when there is none, the framework and backend service it is built on (for example Next.js and Supabase), the size as a range (for example 30K–75K lines), when it was scanned as “today”, “this week”, “this month” or “earlier”, how many critical and high findings it had, and a plain description of the most serious one: what kind of finding it is and what that kind of finding could let someone do.
  • Left out entirely — Private repositories, forks, archived repositories, very small projects and projects that are deliberately insecure for training. The list is not shown at all until there are enough scans that no single one stands out.

To have a public repository left out, email support@systemaudit.dev.

Third-Party Services

We use the following third-party services:

  • GitHub API — To read repository contents for analysis, as described above.
  • Vercel — Hosting, and the AI Gateway that routes analysis requests to the model provider.
  • Managed PostgreSQL database — Stores reports, purchases and account data.
  • Stripe — To process payments securely. See Stripe's Privacy Policy.
  • Anthropic (Claude) — AI analysis, reached through Vercel's AI Gateway with zero data retention and no training on your code.
  • Resend — Report-ready, account-recovery, follow-up and product-update emails.
  • Slack — Internal alerts to our team about scans, sign-ups and failures, which can include the email address you give us.
  • Google Analytics — Aggregate traffic and product usage. We do not send your email address to it.

Data Retention

  • Source Code — Not stored. Files are discarded once the scan has read them.
  • Audit Reports — Kept so you can return to them, re-scan and verify fixes. Email us to have any report deleted.
  • GitHub Token — Kept encrypted while your GitHub account is connected; revoked and deleted when you disconnect.
  • Email Addresses — Retained until you request deletion.
  • Payment Records — Retained as required by law for accounting purposes.

Your Rights

You have the right to:

  • Access — Request a copy of the data we hold about you.
  • Deletion — Request that we delete your data (email us at the address below).
  • Portability — Receive your data in a machine-readable format.
  • Correction — Request corrections to inaccurate data.

For GDPR (EU) and CCPA (California) requests, we will respond within 30 days.

Cookies

We use minimal cookies for essential functionality only (e.g., session management). We do not use tracking cookies or sell your data to advertisers.

Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by posting a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at:

support@systemaudit.dev