Privacy Policy

Account data. Your email address and authentication credentials, handled by our identity provider. We never see or store your password — only a token proving you signed in.

Organization data. Organizations, teams, projects and membership, so we know who may see which findings.

Repository metadata. When you install our GitHub App we receive repository names, default branches, commit SHAs, pull request numbers and installation identifiers for the repositories you select.

Scan findings. Rule identifiers, severities, CWE classifications, file paths and line numbers. A finding may include a short excerpt of the matching line — for a secret-detection rule, that excerpt can itself contain sensitive material.

Integration data. If you connect Jira, we store the issue keys and project keys we create or link.

Operational logs. Request and webhook delivery records used to run and debug the service.

Scans run in short-lived, isolated jobs. A job clones the repository, runs the configured scanners, reports findings, and is destroyed. We do not retain a copy of your source code after a scan completes.

What persists is the findings — including the file paths, line numbers and any excerpt a scanner attached to them.

Our GitHub App requests read-only access to repository contents. It never writes to your code. It does write check runs, commit statuses and pull request comments, which is how results are surfaced in GitHub.

To authenticate you, scope access to your organization, run and schedule scans, normalize and de-duplicate findings, evaluate your policies, and show results in the dashboard and in GitHub.

We do not sell your data. We do not use your source code or findings to train machine learning models.

Only the processors required to operate the service:

• Supabase — database, authentication and file storage.
• GitHub — repository access and posting results back to your pull requests.
• Atlassian Jira — only if you connect it, and only the tickets we create.

We may disclose data where legally required. If that ever happens we will tell you unless we are legally prohibited from doing so.

Findings and scan history are kept for as long as your organization exists, because posture management depends on comparing against history. Ephemeral scan workspaces are destroyed when the job ends. Delete an organization and its findings, repositories and integrations are removed with it.

Traffic is served over TLS. API keys are stored only as keyed hashes — we cannot recover the original value, which is why we show it once at creation. GitHub credentials are short-lived installation tokens minted per scan and scoped to the repositories that scan needs, rather than long-lived credentials.

No system is perfectly secure. If you believe you have found a vulnerability, please report it to the contact below rather than disclosing it publicly.

You can disconnect the GitHub App at any time from your GitHub settings, which immediately revokes our access. You can delete findings, repositories, integrations or an entire organization from the dashboard. You may request a copy of your data, or its deletion, using the contact below.

Questions about this policy, or requests concerning your data: privacy@mayoaspm.com

If we change this policy we will update the date above. Material changes affecting how we use your data will be communicated to organization owners before taking effect.