Skip to main content

Data Handling & Security

How we process, store and protect your source code and findings.

What we store

Files are fetched from GitHub into server memory, scanned and discarded. We never store your repository. We keep the findings (rule code, file path, line number, severity) so they appear in your dashboard and scan history, plus a short code snippet around each finding for context.

AI double-check (opt-in)

Scans are rule-based and send no code to an AI model. On Pro and Team you can turn on an AI double-check in settings. When it is on and a pull request has a critical finding, Zelsis sends the flagged file and up to two files it imports to Anthropic's Claude API and asks whether the code already guards against the issue. At most three findings per pull request are checked. The model can only lower a blocking finding to high; it cannot add, hide or raise findings. Nothing is sent while the setting is off, and Zelsis does not store what was sent.

Retention and location

  • Code snippets are erased automatically after 90 days by a daily database job.
  • Findings and scan history stay in your account until you delete the project or your account.
  • Region: data is stored on Supabase in the EU (Ireland, eu-west-1).

Service-role key

Background jobs that must bypass Row Level Security use the SUPABASE_SERVICE_ROLE_KEY. It lives only in server-side environment variables and is never sent to the browser. Everything you read in the dashboard goes through RLS policies, so you can only see your own and your organization's data.

Data flow

  1. You start a scan from the dashboard, the public preview or the CI gate.
  2. The server fetches the repository files from GitHub into memory (public repos, or private ones with your token).
  3. The static analysis engine scans them; the file contents are discarded when the scan ends.
  4. Findings and short snippets are written to the database; snippets are erased after 90 days.