Security and privacy
Does our code leave for the cloud?
Section titled “Does our code leave for the cloud?”No - your source code never reaches us. Analysis runs on the runner, where your code already lives - that is, inside your own CI pipeline and infrastructure. AppArch does not clone, store, or pull your source to its own servers. Only the analysis outputs (findings, metrics, scores) are sent to us.
What do we collect?
Section titled “What do we collect?”- Account data - name, email, OAuth provider identity.
- Repo metadata - repository name, branch, PR titles, commit SHAs, file paths (not code content).
- Analysis outputs - violation report, dependency graph, scores.
Code content exists only in the runner’s memory at the time of the scan; it is never persisted anywhere.
Encryption and data location
Section titled “Encryption and data location”- TLS 1.3 in transit, AES-256 at rest.
- The SaaS data center is in the EU (Frankfurt) region.
- Email: a provider on SaaS; SMTP on OnPrem (no external service in an air-gapped environment).
On-prem (air-gapped)
Section titled “On-prem (air-gapped)”A full on-premises installation is offered on the Enterprise plan; no data ever leaves.
Responsible disclosure
Section titled “Responsible disclosure”We respect security researchers. If you believe you’ve found a vulnerability, write to [email protected]; we do not pursue legal action against good-faith researchers.