Privacy Policy

1. Information We Collect

1.1 Account Information

• Email address
• Name (optional)
• Company name (optional)
• Payment information (processed by Stripe)

1.2 Code and Scan Data

• Source code files you upload
• Scan results and violations
• Usage statistics

1.3 Technical Information

• IP address
• Browser type
• Device information
• Access logs

2. How We Use Your Information

We use your information to:

• Provide and improve our Services
• Process scans and generate reports
• Send service-related communications
• Process payments
• Prevent fraud and abuse
• Comply with legal obligations

3. Data Security

We implement security measures to protect your data, including:

• Encrypted data transmission (TLS 1.2+)
• Encryption at rest (AES-256)
• Source code processed in isolated environments
• Automatic deletion of source code after scanning (immediately on success, within 24 hours for failed scans)
• API key hashing (SHA-256); we do not store plaintext API keys
• GitHub OAuth tokens encrypted at rest
• Access controls and authentication on all internal systems

No method of transmission or storage is 100% secure. We cannot guarantee absolute security.

4. Data Retention

4.1 Uploaded Code

Code files are:

• Encrypted in transit (TLS) and at rest (AES-256)
• Processed in an isolated environment
• Automatically deleted immediately upon successful scan completion
• For failed scans, retained for up to 24 hours to allow retries, then permanently deleted
• We do not retain, share, or provide access to your source code beyond this window
• No team member has access to your source code during or after scanning

4.2 Scan Results

Scan reports are automatically and permanently deleted based on your plan:

• Free: 30 days
• Team: 90 days
• Business: 365 days (1 year)
• Enterprise: 365 days (1 year), custom policies available on request

Deletion is permanent: scan files, reports, and associated data are fully removed, not archived or hidden.

4.3 Account Data

Account information is retained while your account is active. To request account deletion, contact us at security@scrutora.com. Upon deletion, all associated scans, reports, and tokens are permanently removed.

5. Data Sharing

We do NOT sell your data.

We may share data with:

• Service providers (cloud hosting, payment processing)
• Legal authorities (if required by law)
• Business successors (in event of merger/acquisition)

We may use anonymized, aggregated data for research and improvement.

6. Your Rights

You have the right to:

• Access your data
• Correct inaccurate data
• Delete your account and data
• Export your scan results
• Opt out of marketing emails

Contact us at security@scrutora.com to exercise these rights.

7. Cookies

We use cookies for:

• Authentication
• Session management
• Analytics (optional)

You can disable cookies in your browser, but some features may not work.

8. Third-Party Services

We use the following third-party services:

• Stripe: payment processing
• Amazon Web Services (AWS): application hosting, compute, database, and object storage (PDF reports)
• SendGrid: email delivery
• Google Workspace: business email services
• GitHub, OAuth integration for repository scanning

Each provider has their own privacy policy governing their handling of your data.

9. Children's Privacy

Our Services are not intended for users under 18. We do not knowingly collect data from children.

10. International Users

Your data may be transferred to and processed in the United States. By using our Services, you consent to this transfer. If you are located in the EU or other regions with data protection laws, please be aware that your data will be processed in the United States, which may not offer the same level of data protection as your home jurisdiction.

11. Changes to Privacy Policy

We may update this Privacy Policy. We will notify you of material changes via email. Continued use constitutes acceptance.

12. Contact Us

For privacy questions: