What we do with your code, and what we do not.
Last updated 17 September 2026
This page describes how TraceGuard processes customer data in technical terms rather than legal boilerplate. If your security team needs a formal Data Processing Agreement, ask and we will sign one.
1. Source code handling
TraceGuard is a pipeline, not a repository. When a commit is pushed, the system requests the diff of that change from your Git provider, holds it in memory for the duration of the analysis, and discards it when the analysis completes. We do not clone, mirror or store your repository. Full file contents are not persisted at any point.
One thing is deliberately retained: the specific fragment of the diff that supports a finding. A compliance ticket claiming that a rule was breached without showing the line that breached it is worthless to an auditor, and inventing that evidence later would be worse. So the quoted fragment is stored alongside the verdict, and nothing else is.
That retention window is yours to set. After it expires, the evidence is deleted and the audit trail survives without it: which change was evaluated, against which version of your rule document, what was decided and when. If you prefer no retention beyond the open ticket, that is a configuration value, not a special arrangement.
Commit diffs are transmitted to our language model provider for analysis under a commercial agreement. Your code is never used to train models.
2. Data residency
All infrastructure runs inside the European Union. Application compute is hosted on Vercel in the Frankfurt region (eu-central); the database is hosted on Supabase, also in Frankfurt. There is no replication outside the EU.
Database isolation is enforced at the engine level: row-level security is enabled with no policies on every operational table, so the tables are unreachable by anything other than the server's own service credentials. Every record carries the identity of the customer it belongs to.
Customer credentials — such as an issue-tracker API token — are encrypted with AES-256-GCM before they reach the database, using a key derived per secret and held in the server environment. The database never sees plaintext, including in a backup.
3. Repository access
TraceGuard integrates through a GitHub App with the minimum permissions the product needs:
- Contents: read-only — to read the diff of a change and the files it touches at that revision.
- Issues: read and write — to open a ticket and annotate existing ones. Not required at all if findings go to your own Jira instead.
No organisation-wide access, no administration permissions, no write access to code, no ability to create branches or pull requests. The App is installed only on the repositories you select, and each customer operates with an installation token issued by GitHub for their own installation — isolation between customers is enforced by GitHub, not by our code.
You can uninstall the App from your organisation settings at any moment, without notifying us and without our cooperation.
4. Offboarding
If you stop using TraceGuard, your complete analysis history is exported and handed to you, then deleted in a single cascading transaction covering the account, its repositories, its encrypted credentials and its records. We will show you the exact statement that performs it before running it.
5. Cookies on this website
This page sets no cookies at all. There are no analytics, no third-party trackers, no advertising pixels, no session recording and no fingerprinting scripts. The page loads no external resources of any kind: no fonts, no stylesheets, no scripts from other domains.
If you submit the contact form, the details you type are transmitted to our server and stored so that a person can reply. That is the only data this site collects, and only when you choose to send it.
The product dashboard, which is not part of this website and is reachable only by authenticated operators, sets a single HttpOnly session cookie required for authentication. It carries no tracking information.
6. Your rights
Under the GDPR you may request access to, correction of, or deletion of personal data we hold, and you may object to its processing. Write to diego.macias@traceguard.eu and we will respond within thirty days. In the contractual relationship, the customer is the data controller and TraceGuard is the processor.
7. What this page is not
TraceGuard supports the detection of engineering changes that affect regulatory requirements. It does not certify conformity: that is the role of a notified body. No system connected to the internet is impenetrable, and we will not claim otherwise. We will tell you which attack vectors we have closed and which remain open — before you ask.