Privacy
The short version
We hold what we need to scan your repositories and show you the results: who you are, which repositories you connected, the credentials you gave us for those repositories, and the reports we produced.
Your code is not intentionally executed. It is read and scanned. A paid scan's findings — not your source code — go to an AI provider whenever that scan bundles an AI Review, which then runs automatically.
Who we are
CodexMotiveShield is operated by CodexMotive Digital Solutions, a sole proprietorship registered in Ontario, Canada, with a business address at 206 Candlewood Cres. Unit 1, Waterloo, ON N2L 5Y9.
For anything about this policy or your personal information, contact info@codexmotive.com.
Information we collect
- Account and identity information. You sign in with GitHub or Google and we receive an account identifier, a display name and, where the provider gives it, an email address. GitHub accounts may withhold the email; the service works without it. We use this to know who you are and to secure your account.
- Repository information — the URL, the provider, and the branch you asked us to scan. We need this to know what to scan and where.
- Repository credentials that you supply, encrypted at rest, used only to contact your repository provider on your behalf to run the scans you request.
- Scan data and reports — findings, the files and lines they point at, and, once a scan has been AI-Reviewed, the fix prompts it generated.
- AI Review data — the findings from a completed scan, sent to our AI provider when a paid scan bundles AI Review in. See "AI Review" below.
- Billing information if you buy something, held by our payment provider rather than by us. We never see your card details.
- Analytics and cookie information, only once you grant analytics consent.
- Technical, log and security information — requests, errors, timestamps and IP addresses our infrastructure generates in the ordinary course of running the service.
We do not sell any of it, and we do not use your source code, your findings, or your prompts to train any model of ours.
How we use information
Authentication, running the scans you request, generating reports, maintaining scan history, providing AI Review where it's bundled in, securing the service against abuse, troubleshooting, billing, and customer support are things we do because they are necessary to provide the service you signed up for, or to meet a legal obligation. Analytics is different: it only happens once you've given consent, and stops when you withdraw it.
Repository and source-code processing
A scan clones your repository onto a temporary, isolated worker, runs the scanner tools over the files, writes a report, and the worker is destroyed.
Your repository is not intentionally built, installed, or executed. The runner does not install dependencies, and does not intentionally run a project's postinstall script or any other project-defined script — from your repository or anyone else's. This is a deliberate boundary in how the scanner is built, not a promise that no bug in any tool could ever cause unintended execution.
We keep the report. We do not intentionally keep a copy of your repository after the scan completes. Because a finding has to point at something to be useful, a report can include short excerpts or identifiers drawn from your repository's contents — we don't promise a finding can never contain a fragment of source code, only that we don't retain the repository itself.
AI Review
What is sent, and when
AI Review sends the findings from one completed scan — not your source code — to be read. It runs automatically whenever a paid scan bundles one in; the free first check never has one, and there is nothing here you separately request or pay for again. Findings can include short excerpts drawn from your repository, as described above — if a finding contains one, that fragment is included when the finding is sent.
Which provider
AI Review goes to Anthropic. A Security Check goes nowhere near an AI provider: it runs scanners over your files and nothing it reads leaves the runner.
What we promise, and what Anthropic's own terms promise
We do not use your source code or scan findings to train any model of ours — that is a statement about what we do. Separately, our contract with Anthropic, PBC is governed by Anthropic's Commercial Terms of Service and its Data Processing Addendum (DPA), which is automatically incorporated into that agreement. Under those terms, as published today:
- Training: Anthropic's Commercial Terms state that Anthropic may not train its models on the content we send it through the API.
- Retention: Anthropic's DPA commits to deleting customer data within 30 days of the agreement ending, subject to legal retention exceptions. It does not publish a separate, shorter retention period for data processed while the agreement is active.
- Processing location: Anthropic states that data is stored in the United States. By default, traffic may also route to the US, Europe, Asia, or Australia for processing, and internal processes such as safety review or support may occur in other countries where Anthropic or its affiliates operate. Anthropic's DPA incorporates Standard Contractual Clauses for EU/UK/Swiss transfers as a safeguard for this.
Anthropic's terms can change; this reflects what's published as of this policy's last update, not a permanent guarantee about a third party we don't control.
Repository credentials
Encrypted at rest. No endpoint of ours returns a stored credential in any form. The interface shows you the last four characters so you can recognise which credential is which, and nothing more.
Disconnecting a repository or deleting a project removes its stored credential from our active systems. Because backups exist for disaster recovery, a deleted credential may persist in a backup for a period before it is cycled out — see "How long we keep information" below.
Service providers
Their role differs by function, and so does the relationship:
- Microsoft Azure — hosting, storage and message queues, as our infrastructure provider. Region: Canada and the United States.
- Anthropic — the AI provider for AI Review. A Security Check does not reach them. See "AI Review" above for what governs this relationship.
- Stripe — payments, if you buy something. We contract with Stripe Canada, Ltd., though Stripe's own processing occurs primarily in the United States, as described under "International transfers" below. Stripe collects your payment details directly; its own privacy policy governs that.
- GitHub and Google — sign-in.
- Your git provider — GitHub, GitLab, Azure DevOps or Bitbucket — which we contact with the credential you supplied.
- Google Analytics — usage analytics, only once you grant analytics consent.
Where a provider processes information on our behalf for our purposes, we treat it as our processor. Where a provider has its own independent relationship with you — Stripe processing your payment, or GitHub/Google as your account provider — it may also act as an independent controller for its own purposes.
International transfers
Your information may be processed outside the province or country where you're located, because our service providers operate infrastructure in multiple locations:
- Azure hosting/storage/worker regions: Canada and the United States.
- Anthropic: data is stored in the United States; traffic may also route to the US, Europe, Asia, or Australia for processing by default.
- Stripe: we contract with Stripe Canada, Ltd., but its own DPA states personal data is transferred to Stripe, LLC in the United States, and may reach its other affiliates and subprocessors in other jurisdictions, under Standard Contractual Clauses or the Data Privacy Framework.
- Google Analytics: processed by Google, a U.S. company with globally distributed infrastructure. International transfers rely on Google's certification under the EU-U.S. and Swiss-U.S. Data Privacy Framework, and on Standard Contractual Clauses where that framework doesn't apply.
Because Azure processing occurs in the United States as well as Canada, and because Anthropic, Stripe, and Google Analytics may also process information outside Canada, transferring personal information of Quebec residents outside the province may require a transfer-impact assessment under Quebec's Law 25. We'll confirm the remaining locations and state the specific safeguards in place before this policy is published.
Security
We use safeguards designed to protect your information, including:
- encryption at rest for repository credentials;
- restricted internal access to stored credentials and repository data;
- ephemeral, isolated infrastructure for running scans, destroyed after each scan completes;
- a scanning design that does not intentionally execute repository code;
- no API endpoint that returns a stored credential in usable form.
No online service can guarantee absolute security. We work to protect your information using reasonable safeguards, but we cannot promise that unauthorized access, loss, or disclosure will never occur.
How long we keep information
| Information | Retention |
|---|---|
| Account information | While your account exists, subject to legal retention requirements |
| Repository connection details | While the repository stays connected |
| Repository credential/token | While connected, subject to backup retention below |
| Scan reports | While the related account/project exists |
| Temporary repository clone | Only for the duration of the scan that used it |
| Logs | Default retention of the underlying Azure service — not separately customized |
| Backups | Default retention of the underlying Azure service — not separately customized |
| Billing records | As required by applicable tax and accounting law |
When you delete a project or account, the corresponding information is removed from our active, production systems, as described below. Backups are retained and cycled on their own schedule for disaster recovery; deleted information may persist in a backup for a period before that backup cycles out. We don't describe this as immediate or complete destruction, because it isn't — it's removal from the systems that are actually in use.
Deletion
Deleting a project removes its scan history and its stored repository credential from our active systems. Deleting your account removes your projects, scan history, and repository credentials from our active systems.
Purchase and refund records are the one deliberate exception: we keep them after account deletion, for as long as accounting and tax law requires, the same way Stripe does. Information may also persist briefly in backups, as described above, until those backups cycle out in the ordinary course.
Your privacy rights
We're based in Ontario, which has no general private-sector privacy statute of its own — so the federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs our handling of personal information directly. If you're a Quebec resident, Quebec's Law 25 also applies to you, regardless of where we're based, because it protects Quebec residents based on where they live, not where we operate.
Subject to applicable law and reasonable exceptions, you generally have the right to:
- ask what personal information we hold about you and how it's used;
- correct information that's inaccurate or incomplete;
- withdraw consent for consent-based processing, such as analytics;
- request deletion, as described above;
- raise a concern with us directly.
If you're a Quebec resident, Law 25 gives you additional rights, including the right to know when a decision about you is made through automated processing. We don't currently make any decision "about you" through automated means — scans assess your code, not you.
Not every right applies to every user in every jurisdiction; which rights apply depends on where you're located and which law governs your relationship with us.
Users outside Canada
This applies only to the extent the relevant law actually reaches you.
EEA / United Kingdom
If GDPR or UK GDPR applies to you, we act as controller of your personal information. Our lawful bases are performance of a contract, legitimate interests (security, fraud prevention, service operation), and consent (analytics cookies). You have the rights to access, correct, erase, restrict and port your information, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your local supervisory authority. International transfers rely on appropriate safeguards — see "International transfers" above.
California
The California Consumer Privacy Act only applies to businesses that meet certain revenue or data-volume thresholds. Given our current size, we don't believe we meet them — but if we ever do, California residents will have rights to know, delete and correct their personal information, to opt out of sale or sharing (we do not sell or share personal information), and to non-discrimination for exercising these rights, and this section will be updated to reflect that.
Children's privacy
The service is not directed to children, and we do not knowingly collect personal information from children under 13 (or the equivalent minimum age under applicable law). If you believe a child has provided us with personal information, contact us and we'll take appropriate steps to remove it.
Your repositories
You're responsible for having the right to connect a repository, provide its access credentials, have it scanned, and authorise us to process whatever information it contains — including sending scan findings for AI Review where applicable. The corresponding authorisation and acceptable-use commitments live in our Terms, since they describe what you're agreeing to by using the service. This page describes what happens to information once it's in our systems.
Changes to this policy
We may update this policy as the service changes. If a change is material, we'll notify you before it takes effect — by posting a notice on this page and, where practical, by email or in-product notice. The date at the top always reflects the current version.
Contact and complaints
CodexMotive Digital Solutions, registered in Ontario, Canada, at 206 Candlewood Cres. Unit 1, Waterloo, ON N2L 5Y9. Privacy enquiries: info@codexmotive.com.
If you raise a concern and aren't satisfied with our response, you may escalate it — in Canada generally, to the Office of the Privacy Commissioner of Canada; if Quebec's Law 25 applies, to the Commission d'accès à l'information du Québec; if you're in the EEA/UK and GDPR/UK GDPR applies, to your local supervisory authority.
Related reading: Terms and the questions page, which answers most of this in plainer language.