Privacy Policy

SetRepo scans code and websites for security problems. This page explains what we collect to do that, who else handles it, how long we keep it, and how you can get it or delete it.

What we collect

Your account. Your email address and a hashed password (or, if you sign in with GitHub, your GitHub user id and the email GitHub gives us). We also keep your plan, your scan allowance and, if you've paid, your Stripe customer id.

Your code, briefly. To scan a repository we download it, run the checks, and delete our copy when the scan finishes or fails. A zip you upload for a free quick scan is kept for up to 24 hours, so you can upgrade that scan to a deep scan without uploading again. Then it's deleted. Zips used for any other scan are deleted when the scan ends.

Your reports. What a scan finds: each finding's title, description, file path, line numbers and suggested fix. Secret values are removed from findings before they're saved: a report names the key and where it is, never the key itself. A report is the output of automated checks: it can miss issues or flag ones that aren't real, and it isn't a guarantee that your code is secure (see the Terms).

Live-site checks. If you give us a URL, we load its homepage and the scripts it serves, like a browser does. Deeper checks only run on domains you've verified you control. A verification lasts 30 days.

Operational logs. Our servers log requests, which include email addresses and IP addresses. Secret values and credentials are scrubbed before a line is written, and we never log request bodies. We use your IP address to limit how many free scans can be started from one address in a day; it isn't stored with your scans.

GitHub access

Signing in with GitHub asks only for your profile and email address.

To scan a private repository you install the SetRepo GitHub App on the repositories you choose. It asks for read-only access to their contents and metadata. It can't write code, open pull requests or change settings. For each scan we request a token that works for that one repository, for at most an hour, and is never stored. You can remove the App at any time in GitHub's settings.

Who else handles your data

We use a small number of service providers (sub-processors):

• Anthropic runs the AI review in deep scans. We send it the relevant parts of your code, with secret values removed first. Under Anthropic's commercial terms, this data isn't used to train their models.
• Stripe processes payments. We never see or store your card number.
• Resend delivers our emails (sign-up, password reset, scan finished, receipts, refunds).
• Sentry receives error reports. Request bodies, cookies, query strings, local variables and secret values are removed before anything is sent.
• GitHub provides repository access you grant.
• Our hosting provider runs our servers, and Cloudflare R2 stores encrypted database backups.

We don't sell your data, and we don't use it for advertising.

How long we keep it

• Scans and reports: until you delete them or your account.
• Your code: deleted when the scan ends; a quick-scan zip within 24 hours.
• AI review answers: kept per account so an unchanged file isn't reviewed (or charged) twice, and deleted after 90 days without use.
• Server logs: a few weeks.
• Database backups: 14 days on our server, 30 days off-site (encrypted).
• Payment records: Stripe keeps its own, as the law requires.

Your rights

• Download your data. "Download my data" on the Account page gives you everything we hold about your account (projects, connections and every report) as one JSON file.
• Delete your account. Deleting your account on the Account page removes your account, projects, scans, reports and connections, cancels any subscription and revokes our GitHub access. Copies in backups expire on the schedule above.
• Ask us. For anything else, including correcting your data, email support@setrepo.com.

Cookies

We use only the cookies the app needs to keep you signed in and to protect forms against cross-site requests. We don't use tracking or advertising cookies.

Changes

If we change this policy, we'll update this page and the date at the top.