ScrutoraThe scan can run where your code already is.
If the answer to “does our source leave the building” needs to be no, it can be no. That is a deployment choice, not a different product.
Pick by how much you want to move.
The analysis happens inside your build. Findings return as SARIF to your code host. Source never leaves your infrastructure, and CI scanning needs no account and no API key.
We clone, scan and discard. The working copy exists for the duration of the scan; what persists is the findings and the derived map, not your source.
For AWS you create a read-only role and pin an external id we generate. There is no access key of yours in our database. Azure and GCP use a scoped service principal and service account.
Findings and the derived map. Not your repository.
Findings, with the file path and line they point at, and the derived data map. A path and a line number, not the file.
The working copy is discarded when the scan ends. We are not a code host and have no reason to become one.
Cloud credentials and consent configuration are envelope-encrypted, and the API never returns a stored secret, even to the owner.
The scan works with no outbound access.
The rules ship with the container. A build pool with no route to the internet can still run a full scan, which matters if your pipeline lives inside a VPC with egress locked down. Optional AI remediation guidance is the one part that needs a network, and it is optional.
Run it in a pipeline.
A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.