Privacy Policy

1. Who we are

Allied App Security ("AlliedAS", "we", "us") is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. We are the controller of the account information described here. For data inside your workspaces (code, findings, evidence), we act on your instructions as your processor.

2. What we collect

We collect only what we need to run the service:

• Account information: your email address and, if you sign in with Google, your name. Sign-in is handled by our authentication provider; we never see or store a password.
• Workspace information: workspace and project names, members and roles, settings, verified domains, scan scopes and authorization attestations.
• Repository content: when a scan runs, a read-only snapshot of the connected repository is fetched and analyzed in memory. We do not keep a copy of your code. Findings store the file path, line number and a short excerpt with secrets masked.
• Web testing evidence: for checks against domains you have verified, we keep request and response metadata, hashes and short redacted excerpts. Response bodies are never stored.
• Test credentials you provide for authorization checks: encrypted at rest and released only to the scan job that needs them.
• Support conversations: the messages you send us and our replies.
• Security and audit records: security-relevant actions in your workspace, with IP addresses stored as one-way hashes.

3. How we use it

We use this information to provide and secure the service: authenticating you, running the scans you authorize, producing findings and reports, sending service emails (sign-in links, invitations, alerts and support replies), preventing abuse, and meeting legal obligations.

We do not sell personal information, we do not use your code or findings to train AI models, and we do not use advertising or analytics cookies.

4. AI-assisted features

When AI-assisted fix drafting is enabled, the relevant file excerpt (with secrets masked) is sent to our AI provider to draft a proposed patch. The AI never decides what is tested and never executes anything. Our provider does not use this data to train its models.

5. Service providers

We share data only with providers that help us run AlliedAS, under contract:

• Supabase: authentication and encrypted file storage.
• Railway: application hosting and database.
• GitHub: repository access, only for repositories you connect.
• Brevo: transactional email.
• Stripe: payments, once paid billing is live.
• Google Cloud: isolated scan execution and key management, as we roll them out.
• Anthropic: AI-assisted fix drafting, when enabled.

6. How long we keep it

Scan evidence expires automatically: after 180 days by default (you can shorten this in workspace settings), and after 7 days for sensitive evidence. Findings and reports stay while your workspace exists. Account information is kept while your account is active. Audit records are kept for the life of the workspace so their integrity can be verified.

When you ask us to delete a workspace or account, we delete it, including stored evidence and encrypted credentials, except where the law requires us to keep something.

7. Your choices and rights

You can ask to access, correct, export or delete your personal information, or object to how we use it. Email [email protected] and we will respond within 30 days. Depending on where you live, you may also have the right to complain to your data-protection authority.

8. Cookies

We use only essential cookies: to keep you signed in and to remember interface preferences such as theme. We do not use tracking or advertising cookies.

9. Security

Data is encrypted in transit and sensitive data is encrypted at rest. Workspaces are isolated with database row-level security, and every security-relevant action is written to a tamper-evident audit log. See our Security & safe testing page for details.

10. International transfers

Our providers may process data in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.

11. Children

AlliedAS is a business service and is not directed to anyone under 16.

12. Changes and contact

If we make material changes, we will update this page and notify account owners by email before the changes take effect.

Questions? Email [email protected]. Security reports go to [email protected].