Back to home

Privacy Policy

This page is a working draft and is pending review before release.

What we process

SecureFlow reads the code diff of a pull request in order to scan it for secrets, vulnerabilities and misconfigurations. Scan results, including the file path and the matched snippet, are stored so they can be displayed on the dashboard and audited later.

Third-party processing

Code diffs are sent to Groq for analysis by a large language model. Repository metadata is read from GitHub through a GitHub App installation that you authorise and can revoke at any time.

Retention

Retention windows for findings, webhook events, scan results and audit logs are configurable per deployment. Because SecureFlow is open source and self-hostable, the operator of a given instance controls where data lives and how long it is kept.

Questions

Raise an issue on the project repository for anything not covered here.