Privacy Policy

1. Who we are, and what this policy covers

This Privacy Policy explains how SecureCode ("SecureCode", "we", "our" or "us") handles information in connection with the SecureCode service — our website at usesecurecode.tech, our web dashboard, our VS Code extension, our standalone MCP server, and our APIs (together, the "Service").

Who we are. SecureCode is an independently operated software product, run from Egypt. We are the controller of the information described in this policy, except where section 3 says we act as your processor.

Contact: contact@usesecurecode.tech

This policy does not apply to third-party products you choose to use alongside the Service, or to the code repositories, development environments and applications you operate yourself.

This policy should be read together with our Terms of Service, which incorporate it by reference for the purpose of describing our information-handling practices. Section 20 below explains exactly how the two documents fit together.

2. Key terms used in this policy

• Account Data — information about you and your subscription: name, email address, authentication identifiers, plan, billing records.
• Customer Code — source code, configuration, file paths, dependency information, HTTP response excerpts and other content from your development environment that the Service processes at your instruction.
• Findings Data — the metadata produced by a scan: vulnerability class, file path, line number, severity, confidence score, verification outcome and timestamps.
• Usage Data — technical information generated by your use of the Service: log data, IP address, device and client version, feature usage, error reports.

3. Your role and our role

This distinction matters, and it is in both of our interests that it is written down clearly.

You decide what code to submit. You choose which files to scan, whether related files may be included, and whether to run Attacker Mode. We process Customer Code only on your instruction and only for the purposes covered by the licence you grant us in section 8.1 of the Terms of Service.

You are responsible for the content of what you submit. In data-protection terms, where Customer Code contains personal data — for example, personal data appearing in test fixtures, seed data, configuration files, or in HTTP responses captured by the sandbox — you are the controller of that personal data and we act as your processor. You are responsible for having a lawful basis to submit it and for the accuracy and lawfulness of the content itself.

We are the controller of Account Data, Findings Data and Usage Data, which we process to operate, secure, bill for and improve the Service.

If you require a data processing agreement to cover our processing of Customer Code, email contact@usesecurecode.tech and we will provide our standard DPA, which on execution forms part of the Terms of Service for that processing, as described in section 10 of those Terms.

4. Information we collect

4.1 Information you provide

• Account information: name and email address, and optionally company name and role.
• Authentication information: the identifiers needed to sign you in. Where you sign in through a third-party identity provider, we receive an identifier and your email address from that provider and do not receive your password. Where we manage credentials directly, passwords are stored only as salted cryptographic hashes and are never stored in a form we can read.
• Billing information: we do not collect or store full payment card numbers. Payments are handled by our payment processor, which provides us with a transaction reference, the last four digits of the instrument, billing country and subscription status.
• Support correspondence: the content of messages you send us.

4.2 Information generated when you use the Service

• Customer Code, as described in section 5.
• Findings Data, so that your dashboard, history and reports work.
• Usage Data: log data (access times, endpoints called, IP address), device and extension version information, feature-usage counters, verification outcomes and false-positive rates, and diagnostic or crash reports.

4.3 Information collected automatically on our website

Log data and cookie or similar identifiers, as described in section 15.

We do not deliberately collect special categories of personal data (such as data revealing health, biometric, racial or ethnic, political, religious or sexual-orientation information), and you must not submit such data to the Service. See section 12.

5. How the scanning pipeline handles your code

We have set this out in detail because it is the part of the Service where your expectations should be exact.

• Project Map (local). The map of your endpoints, middleware and authentication paths is built on your own machine using Tree-sitter. The source code parsed to build the map does not leave your device. Only the derived summary relevant to the file being scanned is attached to a scan.
• Agent scan (investigation). An AI investigator reads your files, traces data flows, checks guards, and compares endpoint policies to find vulnerabilities. Code you select for scanning is transmitted to our infrastructure and passed to our AI providers for analysis. It is held in memory for the duration of the request and is not written to our long-term storage.
• Verify subagent (exploit verification). For each high-confidence finding, a verify subagent generates a local exploit test, runs it in a sandbox on your machine (Docker or Deno), and analyzes the output to return a PROVEN, UNPROVEN, or INCONCLUSIVE verdict. The sandbox supports Node.js, Bun, Deno, and Python projects. If no local sandbox is available, the API-side sandbox (on our server) is used as a fallback.
• Related files. To judge whether a finding is genuinely exploitable, a scan may also include a small number of neighbouring files that the scanned file depends on — for example its route middleware or validation helpers — identified by the local Project Map. The number of such files is capped by the secureCode.relatedFilesLimit setting and related-file upload is disabled entirely by setting it to 0. While secureCode.skipSecretFiles is enabled, files that match our secret-detection patterns and files excluded by your .gitignore are not included.
• Fixer. When you request a fix, the relevant code block is processed to produce a candidate patch. Before the patch is returned, the model reviews it against a checklist of eight common bypass techniques. That review is model reasoning about the patch; it is not execution or testing of the patch against your application. Intermediate artefacts exist only for the duration of the request.
• Fix re-verification. After a fix is generated, the pipeline re-runs the original exploit test against the merged fixed code (the original file with the fix applied, reconstructed in memory) to determine whether the fix closed the vulnerability. The merged fixed code is transmitted to our AI providers for this re-verification, under the same commitments described in section 8. The fixed code is not written to your workspace and is not retained after the re-verification completes.
• Finding review queue. When the verify subagent returns INCONCLUSIVE, the finding's metadata (file path, line number, finding type, severity, confidence, verification status — but NOT the source code or evidence strings) is stored in a local review queue at .securecode/finding-review-queue.json so you can later adjudicate it. This queue is per-workspace and never leaves your machine.
• Attacker Mode and the local sandbox. Payload replay runs against a temporary copy of your own application on your own machine, and supports Node.js, Bun, Deno, and Python projects. If you enable AI adjudication, redacted and truncated excerpts of your development server's HTTP responses are transmitted to us for the cases the sandbox's deterministic rules could not resolve. We apply automated masking to credentials and contact details before transmission. Cases the sandbox resolves locally are not transmitted. AI adjudication is disabled by setting secureCode.sandboxAiAdjudication to off.

An honest limitation. Our redaction and secret-skipping are pattern-based. They are designed to catch common formats of credentials and personal data, and they materially reduce what is transmitted, but no pattern-based filter is exhaustive. We do not warrant that they will remove every secret or every piece of personal data. You should not rely on them as your only control, and you must not point the sandbox or Attacker Mode at a production environment or at any environment containing live personal data — see section 12 below and sections 7.3 and 7.4 of the Terms of Service.

6. Why we process information, and our legal bases

Where the GDPR, UK GDPR or a comparable law applies, we rely on the following legal bases.

Where we rely on legitimate interests, we have assessed that interest against your rights and freedoms, and you may object as described in section 14.

7. How we use information

We use the information described above to provide, operate, secure, support, bill for and improve the Service; to communicate with you about it; to detect and prevent abuse, fraud and misuse of API limits; and to comply with our legal obligations.

Aggregated and de-identified data. We may create aggregated, statistical or de-identified data from Usage Data and Findings Data — for example, false-positive rates by vulnerability class, or verification-outcome distributions — and we may use and disclose that data for any lawful business purpose, including calibrating our confidence scoring and describing the Service publicly. We only do this where the data can no longer reasonably be attributed to you and cannot be used to reconstruct your code. Section 8.1 of the Terms of Service grants us the licence to do this. It is different from training a model on your code, which we do not do (see section 8 below).

We do not use the Service to make automated decisions about you that produce legal effects or similarly significantly affect you.

8. AI providers, and our commitments on model training

The Service depends on third-party large language model providers, currently Vultr Inference and OpenRouter. Customer Code you submit for scanning, verification, fix generation, or fix re-verification is transmitted to one or more of these providers to produce the result you requested. Section 9 of the Terms of Service records that this transmission happens on your instruction.

Our commitments:

• We do not use Customer Code to train, fine-tune or evaluate any machine-learning model, and we do not use it to build internal classifiers.
• We configure our AI providers to disable training on the data we submit wherever that provider offers such a setting or contractual commitment, and we contract with them on terms that prohibit using our submissions for model training.
• We rely on those providers' contractual and technical commitments. We do not control their infrastructure and cannot independently audit it.

What their retention actually means. Our AI providers may retain the inputs and outputs of a request for a limited period — typically up to 30 days — solely for abuse and safety monitoring, in line with their own published terms. It is a safety control, not a data-mining exercise: retained data is not used to train models, it sits inside the provider's own security programme under restricted access, and it is deleted on their schedule. We tell you this because a claim that your code is destroyed the instant a scan finishes would not be accurate, and we would rather you decide with the real picture in front of you. What we send is also narrow by design — the file you selected, a capped number of files it depends on, and a summary derived from a Project Map that never leaves your machine, as set out in section 5.

That retention is theirs and not ours. We do not control their infrastructure, we cannot independently audit it, and to the maximum extent permitted by law we are not responsible for their acts or omissions. Your use of the Service, and therefore of those providers, is at your own risk, as set out in sections 12 and 13 of the Terms of Service.

If you require that your code is not transmitted to a third-party model provider at all, email contact@usesecurecode.tech to discuss whether an alternative deployment arrangement is available.

9. Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising.

We disclose information only as follows.

• Sub-processors and service providers who process information on our behalf under written terms that restrict them to our instructions:
  • AI model providers — Vultr Inference and OpenRouter, as described in section 8
  • Cloud infrastructure and API hosting — Vultr
  • Web hosting and analytics — Vercel
  • Database and authentication — Supabase
  • Payment processing — Dodo Payments
  • Transactional email — Resend
  • Web search (CVE intelligence) — Tavily

  We maintain a current list of sub-processors and will provide it on request from contact@usesecurecode.tech. Where required, we will give affected customers advance notice of a material change to that list.

• Professional advisers — legal, accounting and insurance advisers, bound by confidentiality.
• Legal and safety disclosures — where we are required to do so by applicable law, court order or a valid request from a public authority, or where disclosure is reasonably necessary to investigate suspected fraud or abuse, enforce our Terms, or protect the rights, property or safety of SecureCode, our users or the public. Where we are legally permitted to do so, we will make reasonable efforts to notify you before disclosing your information in response to a legal request.
• Corporate transactions — in connection with a merger, acquisition, financing or sale of assets, subject to the recipient being bound to treat your information in a manner consistent with this policy.
• With your consent or at your direction — including any integration you choose to connect.

10. How long we keep information

We keep information only as long as we need it for the purposes described in this policy, or as long as the law requires.

Retention of data by our AI providers for abuse monitoring is described in section 8. We may retain information for longer where we are required to preserve it in connection with a legal claim, investigation or regulatory request.

11. Security

We take security seriously — it is the product. We apply technical and organisational measures appropriate to the risk, including:

• Encryption of data in transit using TLS 1.2 or higher, and encryption of stored data at rest using industry-standard algorithms.
• Role-based access controls limiting internal access to production systems and logs to personnel who need it.
• Authentication controls on administrative access.
• Segregation of customer data at the application layer.
• Logging and monitoring of access to production systems.
• Confidentiality obligations for personnel and contractors with access to customer data.
• A documented process for investigating and responding to suspected security incidents.

Security is not a guarantee, and we do not offer one. No method of transmission over the internet and no method of electronic storage is completely secure. While we work to protect your information using the measures described above, we cannot and do not warrant or guarantee that your information will never be accessed, disclosed, altered or destroyed by a breach of those measures. To the maximum extent permitted by law, we disclaim any such warranty. The disclaimers in section 12 and the limitations of liability in section 13 of the Terms of Service apply to this policy.

You are responsible for the security of your own account credentials, devices and development environment.

12. Your responsibilities for what you submit

These restrictions protect you as much as they protect us. They also apply as terms of our agreement with you, under section 7.4 of the Terms of Service. By using the Service you represent and warrant that:

• You own the code you submit, or you have the rights and permissions necessary to submit it to a third-party service for automated analysis;
• You own, or hold the owner's authorisation to perform automated security testing against, every system you scan and every system against which you run Attacker Mode (Terms of Service, section 7.2);
• You have a lawful basis for any personal data contained in the code, configuration or HTTP responses you submit, and you have given any notices and obtained any consents that the law requires;
• You will not submit special categories of personal data, payment card data subject to PCI DSS, government identification numbers, protected health information, or data subject to sector-specific regulatory regimes, unless we have agreed in writing in advance to receive it;
• You will not point Attacker Mode or the local sandbox at a production environment, or at any environment containing live personal data of real individuals (Terms of Service, section 7.3);
• You will not submit code belonging to a third party in breach of a confidentiality obligation you owe to them.

If you submit data in breach of this section, we may suspend processing and delete the data as described in section 15.2 of the Terms of Service, and the indemnity in section 14 of those Terms applies.

13. International transfers

We are based in Egypt and we use service providers located in other countries, including in the United States and the European Union. Your information will therefore be transferred to, stored in, and processed in countries other than your own, where data-protection law may differ from the law of your country.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate transfer mechanism, which will generally be the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum where relevant), supplemented by additional measures where our assessment indicates they are needed. A copy of the relevant clauses is available on request from contact@usesecurecode.tech.

14. Your rights

Depending on where you live, you may have some or all of the following rights: to access the personal data we hold about you; to have inaccurate data corrected; to have your data deleted; to receive a copy in a portable format; to restrict or object to certain processing, including processing based on legitimate interests; to withdraw consent at any time where we rely on consent; and to opt out of marketing messages.

How to exercise them. Email contact@usesecurecode.tech. We will respond within 30 days. Where a request is complex or we receive a large number of requests, we may extend that period by up to a further 60 days and will tell you if we do. We may need to verify your identity before acting, and we may decline a request where the law permits — for example where it would adversely affect the rights of another person, or where we are required to retain the data. We do not charge a fee for a request unless it is manifestly unfounded or excessive.

No discrimination. We will not deny you the Service, charge you a different price, or provide you with a lower level of service because you exercised a privacy right.

Complaints. If you are in the EEA, the UK or Switzerland, you have the right to lodge a complaint with your local data protection supervisory authority. If you are in Egypt, you may complain to the competent authority under Law No. 151 of 2020 on the Protection of Personal Data. Nothing in our Terms of Service restricts this — section 16.7 of those Terms says so expressly, and the dispute-resolution provisions there do not apply to a regulatory complaint. We would appreciate the chance to address your concern first.

15. Cookies, analytics and telemetry

Cookies. Our website uses only strictly necessary cookies — those required to keep you signed in, maintain your session and preserve your preferences, and to protect against abuse. We do not use advertising cookies, and we do not use third-party cross-site tracking cookies.

Analytics. We use Vercel Web Analytics to understand aggregate traffic to our website. It is cookieless: it does not set cookies, does not store a persistent identifier on your device, and does not track you across other websites. We do not sell or share the resulting data.

You can block or delete cookies through your browser settings. Some parts of the Service will not function correctly if strictly necessary cookies are blocked.

Extension telemetry. The VS Code extension reports diagnostic and usage information as described in section 4.2. It respects the global VS Code telemetry setting, so disabling telemetry in VS Code disables ours.

Do Not Track and Global Privacy Control. We do not respond to browser Do Not Track signals, as there is no common industry standard for them. Where required by law, we honour the Global Privacy Control signal as an opt-out of sale or sharing — which, as stated in section 9, we do not engage in.

16. Age restriction

The Service is a professional developer tool and is not directed to, or intended for, anyone under 18 years of age. Section 1 of the Terms of Service requires users to be at least 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, email contact@usesecurecode.tech and we will delete it.

17. Security incidents

If we become aware of a security incident affecting your personal data, we will notify you and any relevant regulator where and as required by applicable law, without undue delay, and we will provide the information we reasonably have available at the time. We will not delay notification in order to complete an investigation, and we may update our notification as an investigation progresses.

18. Third-party services and links

The Service may link to or integrate with third-party websites and services. We do not control them, we are not responsible for their content or privacy practices, and their handling of your information is governed by their own terms and policies. Review them before you use them.

19. Changes to this policy

We may update this policy. If we make a material change, we will notify you at least 30 days before it takes effect, by email to the address on your account or by a prominent notice in the Service. This matches the notice period for changes to the Terms of Service in section 17 of those Terms. Changes are not retroactive. If you continue to use the Service after a change takes effect, you accept the updated policy; if you do not agree, stop using the Service before the effective date and you may delete your account.

20. Relationship to our Terms of Service

Our Terms of Service incorporate this policy by reference for the purpose of describing our information-handling practices, and section 10 of those Terms says the same thing from the other direction.

Being incorporated for that purpose does not turn the descriptions in this policy into warranties. This policy does not create, and is not intended to create, any contractual right, warranty, representation or obligation beyond those set out in the Terms of Service. If there is any inconsistency between this policy and the Terms of Service concerning warranties, disclaimers, indemnities or limitations of liability, the Terms of Service govern. Nothing in this policy limits any right you have that cannot be limited or waived under applicable law.

21. Governing law

This policy is governed by the laws of the Arab Republic of Egypt, without prejudice to any mandatory data-protection rights available to you under the law of your country of residence.

22. Contact us

Questions, requests or complaints about this policy or our data practices: