Privacy

What we collect when you scan

For a surface scan, we fetch the URL you submit and analyze the response (headers, cookies, TLS certificate, and publicly served scripts). For a deep scan, we clone the repository you submit into an isolated, temporary environment and run security analysis tools against its contents. The target and the resulting findings are stored so your report page works.

Repository contents themselves are not retained after a deep scan completes — they exist only in an ephemeral, per-scan environment that is removed once the scan finishes, fails, or times out. What we store long-term is the analysis output (finding category, severity, file and line reference, and similar metadata), not the raw source code or the raw output of the underlying scanning tools.

What we collect when you create an account

If you sign up, we store your email address, a securely hashed form of your password (never the password itself), and the organization name you provide. We use your email to send account-related messages: email verification, magic-link sign-in, and password reset. We don't send marketing email to this address unless you separately opt in somewhere that makes that clear.

Analytics

We use Umami, a self-hosted, cookieless analytics tool, to understand aggregate usage of this site (page views and a small number of product events, like when a scan is submitted). Umami does not use cookies, does not collect personally identifiable information, and does not track visitors across other sites. We do not use advertising trackers.

Cookies

See our cookie policy for the exact cookies PatchVex sets.

Email delivery

Account-related email (verification, sign-in links, password reset) is sent through Resend, our email delivery provider. Resend processes the recipient address and message content necessary to deliver that email; it does not receive your password or your scan data.

What we don't do

• We don't sell your data.
• We don't use your data to train any AI/ML model — PatchVex does not use AI in the product today, and this will be revisited honestly if that changes.
• We don't share scan targets or findings with anyone other than you and your organization's members.

Contact

Questions about this policy can be sent through the contact channels listed on our contact page.