Security, in plain words.
What we do with your code and data, what our free tools read and keep, and what we do not claim.
On client projects
- Confidentiality first
- We sign a mutual non-disclosure agreement before you share credentials, data or unreleased plans.
- Your code stays yours
- Code is committed to your repositories and deployed to your cloud accounts. Intellectual property for each milestone is assigned to you when that milestone is paid.
- Reviewed before release
- Before a production release we check against the OWASP Top 10 and run automated vulnerability scans, as part of the engagement.
- Honest about certifications
- We are not certified to standards such as SOC 2 or ISO 27001 ourselves. We build to the requirements your own compliance needs set, and we say so up front.
What the free App Health Check reads and keeps
How the health check works- Public information only
- It looks at what any visitor can see: public pages, response headers, the certificate and public DNS records. No password and no code access.
- Derived results only
- We store the findings and scores, not page content, source code or passwords.
- Private reports, deleted after 30 days
- Each report has its own private link and is deleted after 30 days.
- Fixed rules, not a model
- The score comes from fixed, versioned rules applied to what was observed. No AI model decides, scores or writes any finding.
What the free Code Review reads and keeps
How the code review works- Read-only access
- You connect GitHub with read-only access. We cannot change your repository.
- No AI reads your code
- The review is done by fixed checks, not by sending your code to an AI model.
- Code never stored
- Your code is read to produce the findings and is not kept.
Found something, or need more detail?
Email contact@zovintra.com. For contract terms see Contracting & IP; for personal data see the Privacy Policy.