CircleCI

Add the certified orb, call the scan job with your frameworks, and gate builds on compliance findings. Offline, no API key, and your code never leaves the executor.

01 · Setup

2 steps.

01Add the scan job

CircleCI runs the scanner image directly as the job's executor, there is nothing to install.

version: 2.1
jobs:
  scrutora-scan:
    docker:
      - image: ghcr.io/nirvahana/dpdp-scan@sha256:e0f57fe4eb8e507a994302b6cbf61e310a727ccc1af3f4a06265dd6b87eedd78
    steps:
      - checkout
      - run:
          name: Scrutora compliance scan
          command: |
            scan . --no-ai \
              --frameworks dpdpa,hipaa \
              --fail-on high \
              --sarif-output /tmp/scrutora.sarif
      - store_artifacts:
          path: /tmp/scrutora.sarif
workflows:
  compliance:
    jobs:
      - scrutora-scan

02Run the workflow

The job scans offline and stores the SARIF report as a build artifact. fail-on fails the job when a finding at or above your chosen severity is present.

02 · What you get

After the first run.

Build gating

fail-on fails the job on high/critical findings, or run report-only.

SARIF artifact

The report is stored as a CircleCI artifact for download and review.

Obligation citations

Every finding cites the exact obligation, not a generic rule id.

No plugin

It's a standard orb, with nothing to install on your executors.

03 · Questions

The ones people actually ask.

Where do the results appear?

In the job output, and as a stored SARIF artifact on the build for download.

Which frameworks are supported?

DPDPA, HIPAA, GDPR, PCI-DSS, RBI and more, set the frameworks parameter.

Is it free?

Yes, the CI scanning is free with no API key or account.

CircleCI Orb Registry

04 · Try itPUBLIC REPOSITORIES

Wire it into a build.

A public repository, read once and not kept. You get the data map: every personal-data field, where it lands, and who receives it. Or run the container on your own runner, and the source never reaches us.