Note for CleanCode, not page copy. Each dashed marker below is a promise only you can make. They are left showing on purpose: every one is a sentence a security reviewer will ask for, and your current Terms of Service answers several of them in a way that will not survive the question.
We read your source code.
There is no softer way to put it, so here is the rest plainly: what we can see, where it goes, how long we keep it, and what we do not have yet.
We only read
CleanCode never writes to your code. Changes turn up as a pull request somebody on your side approved.
You pick what
You choose the repositories. You can start with one, and you can start with a public one.
You can cut it off
Take the access away in GitHub or GitLab and the connection is dead, without asking us first.
The questions security teams actually ask
Answered here, so you do not have to book a call to get them.
What does CleanCode actually read?
Your code, your configuration, your lockfiles, your build setup, and the history of who changed what. We read the code because the alternative is guessing from commit counts, and guessing from commit counts is what everything else already does.
Does our code leave our own systems?
Yes. It is analysed on our machines, in a sealed container, one per scan, destroyed when the scan ends. If that is not acceptable where you work, tell us before you evaluate us rather than after.
CleanCode to confirm: which country the machines are in, and whether running it on your own hardware is planned.
Can we try it without giving you access to anything?
Yes, and this is the way we would suggest you start. Send a zip file instead of connecting an account:
cleancode scan --zip ./project.zip
Nothing to approve, no access to your organisation, nothing for your IT team to sign off. It is the same analysis.
Do you train models on our code?
This is the question that decides most of these conversations, so it deserves one sentence with no exceptions hidden in it.
CleanCode to commit: one plain sentence. Your Terms of Service currently says no training "except as necessary to provide the Service", and the Privacy Policy does not repeat that exception. A reviewer will find the gap and believe the weaker of the two.
What do you keep afterwards, and for how long?
The copy of your code is destroyed with the container. What stays is the list of findings and the map we built to produce it: what depends on what, and the structure of the code those findings point at.
CleanCode to set: how long that map is kept. The current Terms keep it forever and put it outside deletion requests, which is the single most likely reason a serious buyer walks away.
Who else gets to see it?
The analysis uses AI models from other companies. Naming them is not a courtesy, it is the thing that lets a reviewer check them against their own approved list without opening a ticket.
CleanCode to publish: who those companies are, what each one receives, and a way to be told when the list changes.
What happens when we leave?
Take the access away and it stops immediately. Deleting everything we worked out from your code should be something you can ask for in the product and see confirmed.
CleanCode to state: how deletion is requested, what it covers, and how long it takes.
What we do not have yet.
Every company in this business has a page like this one. Most only list the things they can already say yes to. Here is the other half, because you will find it in week three anyway, and finding it yourself is worse.
- No SOC 2 report. We are small and we have not been through the audit. If your process requires one, we are not ready for you yet.
- You cannot run it yourself. It runs on our machines today. The zip upload exists so you can try it without giving us access.
- The downloads are not signed. The installer checks its own fingerprint instead. This is being fixed.
- No penetration test to share. CleanCode to confirm whether one exists.
Ask us the one this page missed.
If your security review has a question this page does not answer, send it over and we will answer it here rather than only in your ticket. The list is not that long, and everyone deserves the same answer.