Legal

Privacy policy

Effective November 4, 2026 · v1.0

The short version

✓We never train any model on your code.
✓Code is cloned into a throwaway sandbox and destroyed after each run.
✓We keep the security index (facts, not source) until you delete the repo.
✓We only scan repos where you installed our GitHub App.
✓We don't sell data, and we don't run ad trackers.

1. Your source code

When you install the grayhat GitHub App, GitHub grants us read access to the repositories you select, and write access to pull requests and checks. We clone a repository only to index it or to scan a specific commit. Each clone uses a token scoped to that one repository that expires within minutes.

The index stores security facts such as routes, guards, call edges and dependency versions, along with short code excerpts cited in findings. It doesn't store a full copy of your source.

2. Sandboxes

To verify an exploit or test a fix, we may install and run your application inside an isolated virtual machine with restricted outbound network access. The machine never holds our model keys or database credentials, and it's destroyed when the run ends.

3. Models

Analysis runs on open-weight models. Model keys stay with our agent service and never enter the sandbox that holds your code. We never use your code to train any model.

4. Findings data

For each run we keep its status, the findings we confirmed, their reproduction steps, and the credits it used. Findings you dismiss are remembered so we don't raise them again on the same pull request.

5. Sub-processors

Vendor	Purpose	Region
Cloudflare	Edge, agents, blob storage	Global
PlanetScale	Product database	US-East
boat.dev	Isolated scan sandboxes	US
Stripe	Billing	US

6. Deletion

Uninstalling the GitHub App, or removing a repository from it, stops all scanning of that repository. Deleting a repository in grayhat deletes its security index and findings.

7. Contact

Questions about this policy, or a security issue to report? Email hello@grayhat.dev.