Security & data handling
Last updated: September 16, 2026
This page describes how we run the service, what infrastructure we use, and which third parties may process data on our behalf. For legal terms about personal data, see our Privacy Policy.
Architecture & retention (overview)
We never keep a copy of your repository. The files a scan reads are processed and discarded. What a report keeps is file names, line numbers, metrics, findings, the AI-written analysis and one-line excerpts of flagged code, with secret values masked before they are saved. Reports are kept so you can return to them and verify fixes; email us to have one deleted. Public repositories are read with a token that can only read public code. Private repositories are read through the SystemAudit GitHub App. It asks GitHub for read-only access to repository contents and metadata, and only on the repositories you select when you install it; it cannot push code, open issues or change settings. Your GitHub sign-in token is stored encrypted, expires after eight hours and is refreshed only while you stay connected, and is revoked and deleted when you disconnect. You can change which repositories the app can read, or uninstall it, any time in your GitHub settings.
Infrastructure
- Hosting — The web application and API routes are deployed on Vercel, with HTTPS in transit.
- Database — A managed PostgreSQL database for reports, purchases and account data, with row-level security enabled on our tables.
Subprocessors & third-party services
We use the following categories of providers to operate SystemAudit.dev. Specific vendors may change; we will update this table when we add or replace a material subprocessor.
| Category | Purpose | Typical provider(s) |
|---|---|---|
| Payments | Process payments for paid tiers | Stripe |
| Report-ready, account-recovery and follow-up emails | Resend | |
| Internal alerts | Notify our team of new scans, sign-ups and failed analyses, including the email address you give us | Slack |
| Repository access | Read repository metadata and files for analysis: public repos with a public-only token, private repos with your GitHub sign-in | GitHub API |
| Analytics | Understand traffic and product usage | Google Analytics (if enabled for your session) |
| AI / LLM | Analysis, summaries and the chat assistant, with zero data retention and no training on your code enforced per request | Anthropic (Claude), via Vercel AI Gateway |
Enterprise & DPA
Custom data processing agreements (DPAs) and security questionnaires are available when needed for enterprise procurement. Contact us with your requirements.
Contact
Security questions: support@systemaudit.dev