Your project
You submit a public GitHub URL or upload a ZIP of your project directly from the scan box.
Your code is yours. Here's exactly what happens when you scan it.
Security scanning requires trust. You should know exactly how your project and data are handled before you upload anything.
Before you scan
Before you upload your project
We know you're not going to hand your source code to a company you know nothing about. Here's exactly what our data-handling process looks like.
What we access
The GitHub URL or ZIP you submit, read by the scanner to run the vulnerability checks against your code and configuration files.
What we don't access
We don't request access to your GitHub account, other repositories, cloud infrastructure, databases, or any system beyond the project you explicitly submit.
What we store
Your code exists only for the duration of the scan, in an isolated environment. If you purchase a report, we store your email (for delivery) and purchase record - not your code.
What we delete
Your submitted code and every scan artifact are permanently deleted within 24 hours of the scan completing. This happens automatically, not on request.
Who can access it
Nobody manually reviews or reads your code. Scans are run entirely by automated analysis, not by a person looking at your files.
AI training
Your code is never used to train any AI model, ours or any third party's, under any circumstance.
Scan lifecycle
What actually happens, step by step
No mystery server. Here's the full path your project takes from upload to deletion.
1
2
Secure upload
Your project is transferred over an encrypted connection straight into the scanning environment - nothing is written to a shared or persistent drive.
3
Isolated security scan
An automated engine checks your code against 55+ vulnerability rules - secrets, injection, auth gaps, vulnerable dependencies, and more. No human looks at your files during this step.
4
Analysis & findings
Findings are compiled with file, line number, severity, and a suggested fix for each issue detected.
5
Results generated
Your report is generated and shown to you. Free scans show a summary; paid tiers unlock the full findings and fixes.
6
Data retention / deletion
Your submitted code and scan artifacts are permanently deleted within 24 hours. Only your email and purchase record persist, if you bought a report.
Your questions, answered
Questions, answered
No, not beyond the scan itself. Your code exists only for as long as it takes to run the scan, inside an isolated, ephemeral environment. No permanent copy is kept, no backup is made, and nothing is written to long-term storage. Once the scan finishes, that environment and everything in it is torn down.
No. Under normal operation, nobody at Aasim Guard reads, opens, or reviews your source code. Scanning is fully automated — your files are processed by the analysis engine, not by a person. There is no support workflow or debugging process that involves a human viewing your code.
When you submit a GitHub URL or ZIP, it's loaded into an isolated scanning environment and run against 55+ rule-based checks — pattern matching for exposed secrets and known vulnerability signatures, plus project-wide heuristics for things like missing authentication or vulnerable dependencies. The engine reads files programmatically to produce findings; it does not stream your code anywhere else, and no separate human review step exists in this pipeline.
No. Your code is never used to train any AI model, ours or a third party's. It is also never sold, rented, or distributed to any third party for any purpose.
Once the scan completes, your report is generated from the findings and your code's job is done. The submitted code and every temporary scan artifact are automatically and permanently deleted within 24 hours of the scan finishing — this happens on a fixed schedule, not something you need to request.
Only you, by default. Your report is tied to your session or purchase and isn't visible to anyone else. If you generate a shareable report link or a PDF and choose to share it, then whoever you send it to can view it too — access is entirely in your control.
None process your source code. The only third party involved at all is Payonify, which handles payment processing if you purchase a report — we never see or store your card details ourselves. No other subprocessor touches your project.
Your code doesn't require a request — it's automatically deleted within 24 hours of your scan completing. For anything that persists beyond that, like your email address or purchase record, you can request deletion at any time by contacting support.
Product basics
A couple of quick ones
Pro and Teams are quarterly subscriptions, billed every 3 months — cancel anytime. See our Terms of Service for details.
Yes, as many as you like — each project is scanned and purchased independently.
Don't trust us - verify us
Don't just take our word for it.
Security shouldn't depend on vague promises. We've documented how Aasim Guard handles your data so you can make an informed decision before scanning.