Your source code is never the product.
As a startup asking engineering teams to connect their repositories to us, we know the first question is always “what happens to our code?” — here's the honest answer.
Ephemeral scan environments
Every scan runs in a fresh, isolated container that's destroyed the moment the job finishes — your code is never kept around between scans.
Nothing persisted after a scan
We store findings — the rule that fired, the file, the line — never the surrounding source. Your code leaves our infrastructure the moment the scan completes.
Read-only VCS access
The GitHub, GitLab, and Bitbucket apps request read-only scopes. Codevanta cannot push commits, merge PRs, or modify branch protection on your behalf.
Role-based internal access
Employee access to any customer metadata is role-gated and logged. Nobody on our team can browse a customer's findings without an audit trail.
Continuous internal scanning
We run Codevanta against our own codebase on every commit — the same engine, the same rules, no special treatment for our own code.
Working toward SOC 2 Type II
As an early-stage company we're building our compliance program now, with policies in place from day one rather than retrofitted later.
Checked out, scanned, discarded — every time
This is the full lifecycle of a single scan job, start to finish. No step where your code sits around waiting for anything.
Repo checked out
Isolated container, read-only clone
Scan engine runs
214 files analyzed in 8.2s
Findings reported
Posted to PR #482
Environment destroyed
Source code discarded, nothing persisted
Want the full architecture writeup?
We share a detailed data-flow diagram and sub-processor list under NDA during onboarding — just ask.
Request documentation