Security & Trust

Your code stays yours.
Always.

Repository analysis uses a temporary server-side clone. This page describes that processing and its limits; review data handling before connecting private code.

Temporary Analysis Clone

We shallow-clone into a temporary server-side directory and attempt cleanup after analysis. Saved analysis reports exclude source snippets.

AI Provider Handling

Structural chat uses analysis context. The optional Explain from source action sends only your selected excerpt and filename to Google Gemini after a separate confirmation. Confirm provider-retention terms before sharing private code.

Provider Access

Sign-in uses GitHub or GitLab OAuth. Private repository workflows require authorized provider access; review requested permissions.

What happens to your code

A step-by-step breakdown of our analysis pipeline.

You submit a repo URL

We receive the GitHub/GitLab URL. No code has been downloaded yet.

Shallow clone (--depth 1)

We clone the selected repository into a temporary server-side directory. Private workflows use authorized provider credentials.

AST parsing & security scan

We analyze supported files, build resolved import relationships and run available security checks against the clone.

Clone cleanup attempted

Cleanup is attempted after analysis. Cleanup failures are logged; this does not guarantee deletion after a crash or failed cleanup.

Results returned to you

You see the interactive dependency map and security report. Signed-in history saves analysis metadata with source-bearing report fields removed.

Data handling and access

What to check before connecting private repositories.

Stored Analysis Metadata

Signed-in analysis history includes paths, counts and findings metadata; source snippets are stripped from saved reports.

Access Controls

Private and team results require authorized access. Static analysis does not establish the security of every application workflow.

Provider Credentials

Provider credentials are used by server-side repository workflows. Review token storage, scopes and revocation before granting access.

Deployment Details

Ask about the deployed environment, backups and retention settings when assessing Xolvyn for private code.

Questions before connecting private code

Confirm the policies and controls you need; this page is not a compliance certification.

Certification statusAsk us
Data retention and cleanupAsk us
Provider data handlingAsk us
Deployment requirementsAsk us

What we measure

We use two services to keep the product working: PostHog for product analytics, hosted in the EU, and Sentry for error reporting. PostHog receives four events, and each one carries only numbers and fixed labels: how many files an analysis covered, how long it took, how many findings it produced by severity, which stage failed if one did, and which provider you signed in with. Sentry receives errors so we can fix crashes, with the message and every line of the stack trace stripped of file paths and web addresses before it leaves our servers. Neither service ever receives your repository contents, your repository URL, your file paths, your function names, your commit messages or your email address. There is no session recording and no third-party script that watches what you type.

Have security questions?

We are happy to provide more details about our security practices.

Ask about data handling