Privacy

A plain-language summary of how we handle your data. Questions go to [email protected].

What we collect

Account details you give us, like your name and email address.
The products you connect, and the evidence a validation reads from your live surface and your source.
Usage and billing records, so the platform works and we can support you.

To run validations, produce your Passport, and show you findings and fixes.
To operate, secure, and improve the service, and to contact you about your account.
We do not sell your data, and we do not use your source to train models.

The Validator connection reads your repository and cannot write to it. We do not publish or sell source code.
The 6-model AI council judges structured evidence. Runtime diagnosis and runnability inference may use bounded excerpts from manifests and entrypoints after recognized secret patterns are scrubbed.
Every outbound model request is checked against provider and workspace policy and recorded in the model egress ledger.
A Passport is shared only in the sections you choose, and you can revoke access at any time.

We run two analytics tags. Umami is self-hosted on our own domain, sets no cookies, and sends nothing to anyone else.
Google Analytics is a Google product, and it loads only if you accept analytics cookies. Once you do, it sets cookies in your browser and sends page and event data to Google as a third party.
Both record pages viewed and a short list of named actions, like starting a validation or publishing a Passport. Neither receives your source code, your findings, or the contents of a Passport.
You can change your answer at any time with Cookie settings at the bottom of the page. Withdrawing stops Google Analytics and deletes its cookies, and a browser sending Global Privacy Control is treated as a refusal. The site behaves identically either way.