Privacy Policy

Draft. Last updated 2026-10-19. Operator: [LEGAL NAME / ADDRESS]. Contact: [EMAIL].

What we access

When you install the Centurion Cloud GitHub App we receive repository metadata, and, for pull requests in the repositories you select, read-only access to the repository contents at the commit under review. The app has these permissions only: Metadata (read), Contents (read), Pull requests (read), Checks (write). We cannot modify your code.

How your code is handled

Code travels only over encrypted connections (HTTPS/TLS) between GitHub, our server and GitHub's API.
The code is held in memory (RAM-backed storage) during the scan and deleted as soon as the scan ends, whether it succeeds, fails or times out.
We do not write your source code to disk, databases, logs or backups, and we do not use it to train any model.
We do not send your source code to any third party. The dependency check sends only package names and versions from your lockfiles to the public OSV vulnerability database (osv.dev).

What we store

Your GitHub account or organization id and login, the installation id, and the repositories you selected.
Your plan (currently the free Light tier).
Per scan: repository id, pull request number, commit SHA, timestamps, and finding metadata (rule, severity, file path, line number, fingerprint). No source code and no secret values: evidence appears only in the check on your pull request, redacted.

Scan metadata is kept for 90 days, then deleted. Account and installation data is deleted within 30 days after you uninstall the app.

Sharing

We do not sell your data. Our server is hosted at Hetzner (Germany/Finland); it processes data on our behalf.

Security

TLS everywhere, least-privilege GitHub permissions, scanners run in a sandbox without network access, and we never execute code from your repository. Report vulnerabilities to [SECURITY EMAIL].

Your rights

You can uninstall the app at any time from your GitHub settings. To request access to or deletion of your data, email [EMAIL].