How we protect your code
You are trusting a security scanner with access to your code. That trust has to be earned, so here is how we handle it.
Your code and data
- Your source code is not stored. We read it for the scan. Findings keep only the file path, the line and a short excerpt.
- Your code does not train AI models. AI review runs on Amazon Bedrock, which does not use inputs to train models.
- Secrets stay secret. If we find a secret in your code, we show a redacted preview. The full value is never stored.
- You can have your data deleted. Ask us, and we delete a repository's or an organization's data completely.
Access
- Your permissions carry over. People see only the repositories their own GitHub or GitLab account can open.
- Your activity is on record. Each customer has an append-only audit log, which you can export.
Our infrastructure
- Scanners can't be reached from outside. The scan worker accepts no inbound traffic.
- Connections are encrypted. All traffic uses TLS.
- Credentials are locked away. They live in a managed secret store, never in our code or images.
- We watch for trouble. Production logs are kept for a year, and changes to access or secrets raise an alert.
How we work
- Written policies. Our founders have approved and signed a formal set of security policies. They cover access, change management, incident response, business continuity, vendors and data retention.
- Controlled releases. Every change is tested and runs on staging before production. Production releases need a second person's approval, and any emergency exception is recorded for review.
- Regular testing. We run our own vulnerability assessments and fix what they find. We also scan our own code and dependencies with Vybscan.
Standards
We are aligning our security program to SOC 2 criteria. We have not yet completed a SOC 2 audit, and that and an independent penetration test are on our roadmap.
We have also submitted a CSA CAIQ v4.1 self-assessment to CSA STAR Level 1.
Talk to us
If your security team needs detail, write to contact@dheemai.com. We can share our completed CAIQ and our assessment reports.