What we hold, and who else sees it
We read your repository, store what we read, and on the paid tier send parts of it to a model provider. This page names each of those precisely, because we sell a product that catches companies failing to name them and we would be indefensible holding ourselves to a lower standard. It also names what is not built yet, in the same voice.
What do you store about my code?
| What | Where | How long |
|---|---|---|
| A file listing at one commit | our database | until you delete the source or the organization |
| File contents, deduplicated by hash | our object storage | same |
| What the agent concluded, and its citations | our database | same |
| A step-by-step record of every agent run | our database | same |
The listing and the contents are what makes a finding checkable later. Without them, "your code imported this in July" is a claim with nothing behind it.
A per-file cap and a per-organization storage cap both apply, so a very large repository is refused rather than silently truncated. A truncated listing that looked complete would produce a map of your codebase that reads exactly like a map of your codebase.
Does my source code reach a third party?
On the paid tier, yes. The agent that reads what your code does with data is a language model, and running one means sending it the code being read. That is the model provider, and under GDPR they are our subprocessor and we are yours.
On the free tier, no. The deterministic scan makes no model calls at all. It reads manifests and config in our own process. The one model call the free tier ever makes is during onboarding, to turn your answers into document text.
Which subprocessors are there?
This is where this page is currently incomplete, and saying so is the point.
Our own published privacy policy lists four subprocessors and does not name the model provider. That document predates the agent, and the omission is exactly the class of gap this product exists to detect: a dependency present in the system and absent from the disclosure.
We found it by running our own reasoning against ourselves. It is being corrected, and the mechanism that keeps it corrected is the part worth stating: SCADABLE becomes a tenant of SCADABLE, the subprocessor list lives in the repository beside the code, and the build fails when the list we serve stops matching the list we hold. A promise to remember is not a mechanism.
Until that ships, treat the live policy as known-incomplete on this specific point rather than as current.
What is not built yet
Stated plainly, because a trust page that only lists what exists is a marketing page.
| State | |
|---|---|
| A data processing agreement | not written |
| A published subprocessor list | not written |
| Customer-initiated account deletion | not built. Deletion is a request to us today |
| A retention window on indexed code | not implemented. It is held until deletion |
| Redaction of source code in agent traces | not built. Staff with console access can read them |
| An audit log of staff actions on customer data | not built |
Every one of those is tracked work rather than an oversight we are hoping nobody notices. The reason they are on this page is that you are entitled to decide, before connecting a repository, whether their absence is acceptable to you.
What we never do
We never write to your repository except a pull request. The integration snippet arrives as a branch and a PR you merge or close. Nothing is pushed to your default branch, and that is what the code implements rather than what a token happens to permit.
We never run exploits against your systems. Penetration testing is referred out, never performed in-house.
Your published documents never stop serving. Not on cancellation, not on failed payment. Your website links to that address.
Frequently asked
Can I use SCADABLE without any model reading my code?
Yes. The free tier's scan is deterministic and makes no model calls. You will get the gaps a manifest can prove and not the ones that need reading.
Who at SCADABLE can see my source?
Staff with console access can read agent run traces, and those traces contain code. There is no redaction layer today, which is listed above rather than omitted.
Updated 21 days ago