Privacy Policy

Last updated: August 17, 2026

1. Who we are and how to reach us

Assurly is a pre-deploy security scanner for web applications. It is offered as a hosted web application and dashboard, a command-line scanner, an MCP server, and a GitHub integration.

For the purposes of the EU General Data Protection Regulation (GDPR), the data controller for the personal data described in this policy is:

  • Tibor Kútik
  • Address: Hlavná 454, 941 33 Kolta, Slovak Republic
  • VAT identification number: not registered for VAT
  • Contact: our contact form (select Privacy / Data Protection)

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy enquiries are handled directly at the address above.

2. The short version

  • We do not sell your personal data, and we do not use it for advertising or behavioural profiling.
  • We set only strictly necessary cookies. No analytics, advertising, or tracking cookies.
  • We do not retain complete copies of your source code. Scan results store findings and file paths, not whole files.
  • Our optional AI features send limited context — never your full repository — to Anthropic. See section 6.
  • Our AI provider does not train models on data we send through its commercial API.

3. How your source code is processed

Where your code is processed depends on which scanner you use:

  • CLI scanner: runs entirely on your machine or inside your own CI/CD runner. Your code never reaches our servers.
  • Manual web checker: pasted snippets, selected folders, and ZIP files are parsed and analysed in your browser. Their contents are not uploaded to our application server.
  • Public GitHub web scan:your browser requests repository trees and selected files through our server API. Our server retrieves that content from GitHub and returns it to your browser for analysis. Source content therefore passes transiently through Assurly's servers, but is not written to our database.
  • Connected and private GitHub scans: our server retrieves repository content using a short-lived GitHub App installation token. Webhook-triggered scans analyse that content server-side. We store scan metadata and findings — including file paths, line numbers, and finding messages — but we do not store complete repository source files.
  • Live URL probes: where you have verified ownership of a target URL, we make requests to that URL and record redacted evidence of what a finding was based on. We store a summary and a redacted sample, not full responses.

Please do not deliberately submit live secrets or production credentials. Although complete source files are not retained, content handled by our GitHub integrations is transmitted over encrypted connections between your browser, our servers, and GitHub as described above.

4. Personal data we collect

4.1 Account and identity data

When you sign in with GitHub, our authentication provider supplies us with your user identifier, email address, display name, and avatar URL. We store your workspace membership and role (administrator or member).

4.2 Workspace and billing data

We store your workspace name, billing plan, GitHub organisation and installation identifiers, and — if you subscribe — the Stripe customer, subscription, and price identifiers together with billing event records. Pro checkout, including the 3-day free trial, collects a payment method on Stripe; no charge is taken until the trial ends unless you cancel first. We never receive or store your full card number; card data is handled exclusively by Stripe.

4.3 Scanning and product data

These records relate to the projects you ask us to check:

  • Guarded targets: repository names, application URLs, display names, a technology fingerprint, ownership-verification status and method, current verdict and Ship Score.
  • Scans: commit SHA, branch, status, and error/warning counts.
  • Findings: rule identifier, severity, confidence, file path, line number, message, and remediation suggestion.
  • Probe evidence: a summary and a redacted sample supporting a finding.
  • Fix outcomes: rule identifier, fix strategy, outcome, pull-request URL, and deployment identifier.
  • Alert preferences: the channel you choose and, where applicable, the webhook URL you supply.
  • Shared reports: if you generate a share link, the report becomes accessible to anyone holding that link until you revoke it.

4.4 API keys

We store a label you choose, a short non-secret display prefix, an irreversible SHA-256 hash of the key, the plan tier, and the time the key was last used. The plaintext key is never stored — it is shown to you once at creation.

4.5 Technical and security data

  • Server logs: our hosting provider records connection details such as IP address, user agent, and timestamps. Our application logs contain request identifiers and operational metadata, and are not intended to contain repository source content.
  • Rate limiting: to protect the service from abuse we apply per-caller limits. Identifiers used for this purpose are pseudonymised with a keyed hash before storage, so the stored value cannot be read back as an IP address or account identifier.
  • Webhook deliveries: delivery identifiers, event types, installation identifiers, processing status, and any error message, retained to prevent duplicate processing.

4.6 Support correspondence

If you contact us through the support form, we collect your name, email address, subject, and message, and use them solely to answer you.

5. Purposes and legal bases (Article 6 GDPR)

PurposeDataLegal basis
Creating your account and operating the dashboardIdentity, workspace, membershipPerformance of a contract — Art. 6(1)(b)
Running scans, probes, and producing verdictsTargets, scans, findings, evidencePerformance of a contract — Art. 6(1)(b)
Taking payment and managing subscriptionsBilling identifiers, plan, billing eventsPerformance of a contract — Art. 6(1)(b)
Sending service and alert notifications you enableEmail address, alert preferencesPerformance of a contract — Art. 6(1)(b)
Optional AI deep reviewTarget URL, findings, limited app contextPerformance of a contract — Art. 6(1)(b)
Answering support requestsName, email, messageConsent — Art. 6(1)(a)
Security, abuse prevention, and rate limitingPseudonymised caller identifiers, logsLegitimate interests — Art. 6(1)(f)
Meeting accounting and tax obligationsInvoice and transaction recordsLegal obligation — Art. 6(1)(c)

Where we rely on legitimate interests, our interest is keeping the service available, secure, and free from abuse. We have considered your rights and freedoms and use pseudonymisation to reduce the impact on you. You may object at any time — see section 11.

6. Artificial intelligence features

Assurly includes optional AI-assisted features: a deep review layer that reasons about scan findings, and generated remediation prompts. These are powered by Anthropic's Claude models, accessed through Anthropic's commercial API. You are interacting with an AI system when you use these features.

6.1 What we send

When an AI feature runs, we send Anthropic a bounded context consisting of:

  • the target application's origin (its URL);
  • a technology fingerprint and framework hints;
  • the rule identifiers and messages of findings already produced by our own non-AI scanner; and
  • a truncated application context sample, limited to a maximum of 3,000 characters.

We do not send your repository, complete source files, credentials, or your account identity.

6.2 How that data is handled

Anthropic states that, by default, inputs and outputs from its commercial API are not used to train its models. Anthropic processes this data as our sub-processor.

6.3 No automated decisions with legal effect

AI output is advisory. It annotates and explains findings; it does not make decisions producing legal or similarly significant effects concerning you within the meaning of Article 22 GDPR. A verdict is a recommendation about software, not about a person.

6.4 Accuracy

AI-generated explanations can be incomplete or wrong. They do not guarantee security or production readiness, and you remain responsible for verifying your own configuration before deploying.

7. Sub-processors and recipients

We use the following processors. Each acts on our documented instructions under a data processing agreement.

ProviderFunctionData involved
SupabaseAuthentication and database hostingAccount identity, workspace, scan and billing records
VercelApplication hosting and deliveryServer access logs, request metadata
StripePayment processing and billing portalBilling identifiers, payment details you enter on Stripe pages
AnthropicAI deep review and remediation promptsTarget URL, findings, limited app context (see section 6)
ResendTransactional and support email deliveryName, email address, message content
GitHubSign-in and repository accessAccount identity, repository content you authorise

We may also disclose personal data where we are legally required to do so, or to establish, exercise, or defend legal claims. We do not sell personal data.

8. International transfers

Several of our processors are established in the United States, so your personal data may be transferred outside the European Economic Area. Where that happens, we rely on one or more of the safeguards permitted by Chapter V GDPR:

  • the European Commission's adequacy decision for the EU–U.S. Data Privacy Framework, where the recipient is certified under it; and/or
  • the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), supported by additional technical measures such as encryption in transit.

You may request a copy of the safeguards applied to a specific transfer by contacting us.

9. How long we keep data

CategoryRetention
Account, workspace, and membership recordsFor as long as your account exists
Scans, findings, probe evidence, and fix outcomesDeleted when you delete the scan or target, or with your account
API keysUntil you revoke or delete them
Rate-limiting recordsShort-lived; expire automatically after their window
Webhook delivery recordsRetained only as long as needed to prevent duplicate processing
Support correspondenceUp to 24 months after the enquiry is resolved
Invoices and accounting recordsAs required by applicable tax law (typically 10 years)
Server logsPer our hosting provider's standard retention period

When you delete your account, associated workspace records are removed by cascading deletion. Records we must keep for legal reasons, such as invoices, are retained for the statutory period and then deleted.

11. Your rights

If you are in the European Economic Area or the United Kingdom, you have the following rights in relation to your personal data:

  • Access (Art. 15) — obtain confirmation of whether we process your data and receive a copy of it.
  • Rectification (Art. 16) — have inaccurate data corrected and incomplete data completed.
  • Erasure (Art. 17) — have your data deleted where one of the grounds in the GDPR applies.
  • Restriction (Art. 18) — have processing limited in certain circumstances.
  • Data portability (Art. 20) — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
  • Objection (Art. 21) — object at any time to processing based on our legitimate interests.
  • Withdraw consent (Art. 7(3)) — where we rely on consent, withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, submit a request through our contact form — the Privacy / Data Protection subject is preselected for you. We respond within one month, which may be extended by two further months for complex requests, in which case we will tell you.

11.1 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). Our lead supervisory authority is:

  • Úrad na ochranu osobných údajov Slovenskej republiky
    Hraničná 12, 820 07 Bratislava 27, Slovakia
    dataprotection.gov.sk

If you are in the United Kingdom, you may instead complain to the Information Commissioner's Office (ico.org.uk).

12. Security

We apply technical and organisational measures appropriate to the risk, including encryption in transit, row-level security isolating each workspace's data, irreversible hashing of API keys, pseudonymisation of rate-limiting identifiers, signature verification on inbound webhooks, and least-privilege access to production systems. No system is perfectly secure, and we cannot guarantee absolute security.

If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and inform you where the breach is likely to result in a high risk to you.

13. Children

Assurly is a professional developer tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to this policy

We may update this policy to reflect changes to the service or the law. We will update the "Last updated" date above, and for material changes affecting your rights we will provide additional notice in the application or by email before the change takes effect.

15. Contact

All privacy enquiries and data-subject requests go through our contact form, which opens with the Privacy / Data Protection subject already selected. Using the form means your request reaches us with the right category and is not lost to a spam filter.