What we keep, what leaves, and how to delete it

• Account

  Your name, email, and either a bcrypt-hashed password or your GitHub sign-in identity. Organization membership and roles.

• Repository metadata

  File paths, sizes, languages, and content hashes — enough to render reports and diff scans, nothing more.

• Audit results

  Findings, health scores, architecture facts (modules, routes, imports, models), fix plans, and generated reports. Secret-detection findings record the location and credential type — never the secret value itself.

• Local CLI receipts

  The CLI writes receipts and signing keys on your machine. CodeTruss receives none of that local state unless you explicitly run codetruss sync..codetruss.yml is the reviewable policy that may be committed. .codetruss/ contains local receipts, patches, snapshots, signatures, signing material, and generated runners. CodeTruss adds that directory to the repository-local Git exclude, verifies the evidence paths remain ignored, and refuses to continue if evidence is tracked or routed through unsafe paths. A normal git add .therefore does not stage it. A synced receipt can include the task, relative changed-file paths, commit hashes, scope classifications, analysis profile, analyzer findings, verdict and reasons, invocation kind and provenance label, optional Claude/Codex hook surface, issuing CLI version, and an optional LLM summary. Before upload, the CLI removes the absolute repository path, agent command arguments/start errors, and verification commands/output. The patch is never uploaded.

• Billing

  Handled by Stripe. We store your subscription tier and Stripe customer ID; card numbers never touch our servers.

Hosted scans never keep a copy of your source code. Each hosted scan downloads a read-only snapshot into a temporary workspace, analyzes it, and deletes the workspace when the scan finishes — whether it succeeded or failed. Your code is never executed or persisted by that scan path. The separate CLI sync path stores only the redacted receipt you deliberately select. Local receipts may contain more detail; review them before sharing or storing them outside your machine.

• AI providers

  Audit reports are generated from architecture facts— module flow, routes, findings — never your raw source. One clearly opt-in exception: when you approve an automated fix PR, the contents of the affected files (at most 4 files, 48 KB each) are sent to your configured AI provider to generate the change. On Pro and above you can bring your own provider keys so that traffic stays in your own account.

• CLI provider review

  Deterministic CLI analysis does not contact an AI provider. If you add--llm, CodeTruss supplies the bounded task, reviewed diff prefix, fixed review instructions, and response schema directly to Anthropic or OpenAI with your API key, or through your authenticated Claude Code installation. OpenAI API requests set store: false; provider retention and abuse monitoring remain subject to your provider agreement. The local Claude path uses Claude Code login state rather than API-key environment variables, disables tools and customizations, and may still add runtime instructions or metadata. No provider review request passes through CodeTruss servers.

• CLI sync

  codetruss sync uploads only a redacted form of the selected receipt to your CodeTruss organization: task, relative file paths, commit hashes, scope, analysis profile, analyzer findings, verdict, reasons, invocation kind and provenance label, optional Claude/Codex hook surface, issuing CLI version, and any LLM summary. It excludes the absolute repository path, agent command arguments/start errors, verification commands/output, and patch. There is no background upload or automatic synchronization.

• OSV.dev

  During the vulnerability check, the names and versions of your direct dependencies are sent to the OSV.dev database — never any code. This runs on every scan and cannot currently be switched off per organization; we disclose it here instead of hiding it.

• GitHub

  Issues, milestones, and pull requests that you ask CodeTruss to create appear in your repositories under your installation’s permissions.

• Stripe & Resend

  Stripe processes payments; Resend delivers transactional email (invites, verification, scan-complete notices).

• Website analytics

  The website uses Vercel Web Analytics for anonymous, aggregate page views and custom events. Separately, CodeTruss sets a 30-day first-partyct_first_touch cookie containing campaign source and medium, optional UTM fields, landing path, referrer hostname, and capture time. We use that attribution to understand signups, public audits, sample-report views, install-command copies, and design-partner interest clicks. These website signals contain no source code, repository data, diff, or receipt; they are not CLI telemetry and do not prove installation, consent, enrollment, or product success.

That is the complete list. We do not sell your data, share it with advertisers, or run third-party ad trackers.

CodeTruss uses a GitHub App with least-privilege permissions: repository contents (read/write, for snapshots and fix-PR branches), pull requests (read/write), issues (read/write, for roadmaps), and metadata (read). Repo operations use short-lived installation tokens that expire after about an hour. You can revoke everything at any time by uninstalling the app from your GitHub settings — no support ticket required.

Deleting a repository from the dashboard removes its metadata, findings, scans, and reports. To delete your account or organization entirely, email zack@codetruss.com from your account address and we will remove your data from our production systems within 30 days.

If this policy changes in a way that matters — new data collected, new third parties — we will update this page and its date, and email account owners for anything significant.