Security & data
You trust us with access to your repos and your compliance. Here's exactly what we do — and don't do — with your data.
We don't read your source code
CRAcheck reads only dependency manifests (package.json, requirements.txt…) and repo metadata. Your code content is never read or stored.
Hosted in the European Union
Your application data (account, scans, profile) is hosted by Supabase in the eu-west-1 region (EU). The app is served by Vercel.
Delete at any time
You can export or delete all your data from your account. After account deletion, it is erased within 30 days.
GitHub / GitLab permissions requested
Sign-in uses the GitHub App (or GitLab OAuth). CRAcheck requests READ-only access to the metadata of the repos you choose to connect and to their dependency files. No write access, no access to your other, unconnected repos. You can revoke access at any time from your GitHub/GitLab settings.
What we read — and what we don't
READ: repo name, visibility, and dependency manifests to build the SBOM and detect vulnerabilities. NOT READ: your code content, secrets, commit history, issues or your other repos. We never write to your repos (you commit the SECURITY.md file yourself if you wish).
Encryption & isolation
All connections are encrypted (HTTPS/TLS). Data access is isolated per user at the database level (Row Level Security): no one can see another account's data. Payments are handled by Stripe (PCI-DSS Level 1 certified) — no card data passes through or is stored on our servers.
Subprocessors & location
Supabase (database, EU), Vercel (hosting), Stripe (payments), Resend (emails), Crisp (support), GitHub/GitLab (integration), Sanity (blog content). Any transfers outside the EU are governed by Standard Contractual Clauses and/or the EU-US Data Privacy Framework. Full detail in the privacy policy.
Retention & deletion
Your data is kept while your account is active. You can export or delete everything from your account; after account deletion, data is erased within 30 days (except accounting obligations: invoices are kept 10 years by law).
For the full legal detail of data processing:
Privacy policy →