CodeSnifAI

Security Measures

• Authentication uses OAuth tokens from connected providers.
• Tokens are encrypted before storage (AES-256).
• All application traffic and provider API communication is encrypted over HTTPS/TLS.
• Access to production systems is restricted using role-based permissions and least-privilege controls.
• Security incidents are handled using a documented incident response process.

Data Collection and Use

• CodeSnif processes repository metadata, file trees, dependency relationships, analysis outputs, and scan findings required to provide the service.
• CodeSnif does not collect or store provider account passwords.
• Integrations with third-party platforms are performed via OAuth and/or provider-issued API credentials.
• Data is used only to deliver product features, improve reliability, and provide customer support.

Repository and Customer Data Storage

• Repository analysis data is stored until deleted by the customer or workspace owner.
• Account owners can remove repositories or delete their account to initiate deletion of associated data.
• Backup systems may retain deleted data for a limited retention window before expiration.

Infrastructure and Subprocessors

• Hosting provider: Digital Ocean
• Primary data region: US

Employee Access

• Team access to private repository content is restricted and audited.
• Staff access is limited to support, security, or abuse-prevention needs.
• When feasible, explicit customer consent is obtained before accessing customer data for support.

Data Retention and Deletion

• Data is retained only as long as needed to provide services and meet legal obligations.
• Customers may request deletion of account and associated data at any time.
• Certain records may be retained where required by law, compliance, or legitimate security purposes.

Contact

• For security or privacy requests, contact: support@codesnif.com