Security & data
Clear data boundaries.
Here is what we process, what we keep and what we can't promise, written out separately.
Authorization before any scan
Having an account or a plan is not permission to scan a server. Scope, profile, expiry, budget and revocation are checked before a scan starts and again while it runs. If the authorization goes away or a stop condition is hit, the work stops.
Source code is processed briefly
Diffs and repository chunks are not written to the durable database or the persistent job queue. They sit in a separate, short-lived store with a bounded expiry, are read once for analysis, and are cleaned up when the job finishes or fails.
What we keep
Findings, scan and job metadata, workspace data and audit records are kept because the product needs them. Reports have their own lifecycle.
AI providers
Analysis requests are sent to AI providers with a zero data retention (ZDR) request. That is a rule we enforce on our side. We have not independently verified how providers honor it.
Accounts and access
Separate roles within an organization, multi-factor authentication for sensitive actions, revocable sessions and data separation between organizations. Security-relevant events go into an append-only, hash-chained audit log.
Vigito reports give evidence about the records you select. They are not a compliance assessment or a guarantee that a system is secure. Nothing on this page is a certification or compliance statement.