Privacy Policy

First effective: 1 June 2026 · Last updated: 2 October 2026 · Operator: Rexstart Labs Pvt Ltd · Contact: open a support ticket or support@audytx.com

At a glance

1. Your source files are analyzed in memory and are not stored.
2. Scan records and their findings are kept for 90 days, then deleted.
3. Account, contact-form and Cost Sampler details are stored as listed below.
4. Cloudflare keeps operational logs for 7 days.
5. There are no third-party analytics, advertising or data-broker services.

What we collect

• GitHub App path. When a pull request is opened, audytx fetches Terraform files (.tf, .tf.json, .tfvars, .tfvars.json) and CloudFormation templates from your repository via the GitHub Contents API. These files are loaded into memory, analyzed, and immediately discarded. No source file content is written to any database or log.
• Plan and change-set uploads. If your workflow uploads terraform show -json output or a CloudFormation change set, it is analyzed in memory in the same way and is not stored.
• Scan and call records. For each call we store the account or installation identifier, the tool and client names, the outcome, the time, and counts of resources, files and findings by rule, severity and reasoning axis. Numbers and identifiers only: no finding text, no file content, no secret values, and no personal data beyond the account identifier. The scan's request and result pass to the analytics service through temporary object storage and are deleted as soon as they are processed.
• Installation records. When the GitHub App is installed, suspended, or uninstalled, we record the installation ID, the account login and account type (user or organization) it belongs to, the GitHub user ID of the person who installed it, and the matching timestamps. We use them to count active installations and to show an installation's scans to the account that owns it. No emails, no tokens, no repository lists.
• MCP path. Requests to POST /mcp are stateless, and audytx keeps no copy of your code: file contents sent in the request body are processed in memory and are not stored by audytx, and no request body is logged. If you ask an autofix tool to open a pull request, the fixed files are committed to your repository with the token you supply. Accepted scan operations write immutable quota events, and each call adds one metrics row (tool name, client name, counts and timings). Non-scan helpers are free. None of these records contains Terraform or CloudFormation source.
• Accounts and sign-in. Your email, your name, an optional company email, your plan, your sign-up and last sign-in times, and your GitHub user ID if one is linked to your account. Sign-in uses an emailed code: no password is stored, and the code is kept only as a keyed hash. Each browser session records its IP address and browser string. Client IDs are stored as a SHA-256 hash with an 8-character prefix. We email you sign-in codes and a welcome message, and quota warnings or a weekly digest according to your notification settings. When you create an account, a notice with your name and email goes to a staff mailbox.
• Contact and abuse forms. The name, email, company and message you submit are emailed to a staff mailbox and kept in our database.
• Cost Sampler. The Terraform archive you upload is analyzed in memory and discarded. We keep the report (savings and resource names) together with the email you typed, which is not verified, and whether you ticked "Send me follow-up email about audytx". We use that address to follow up about audytx only if you ticked the box. To stop, write to support@audytx.com.
• Operational logs. Cloudflare Workers Logs keep a record of each request our Worker serves (the request, the response and related details Cloudflare supplies), together with audytx's own operational events: event code, timing, outcome, HTTP status, counts, and identifiers such as scan, account and request IDs. A sample of request traces is kept as well. audytx's own events carry no source code and no request bodies.
• Website. We do not use third-party analytics scripts. audytx sets only cookies the site needs to work: a session cookie, a short-lived cookie during email sign-in, and a two-minute cookie that shows a dashboard notice. No analytics or advertising cookies.

What we do not collect

• Terraform or CloudFormation source code, HCL or template file contents, or any infrastructure configuration beyond what is required to produce a scan result — and that content is never persisted.
• AWS credentials, secrets, or sensitive values found in scanned files. If a hardcoded secret is detected, the finding records where it is (resource, file path and line number) — the secret value is never stored.
• Passwords. Sign-in uses an emailed code or GitHub.
• IP addresses for tracking or profiling. Session records and the sign-in throttles do include the client IP for abuse defense — never for tracking, analytics, or sale. Our hosting provider may also log IPs transiently at the network layer per its own privacy policy.

Data retention

• Removing the GitHub App from your repository or organization stops audytx's access to it. It does not delete stored data: scan and call counts are kept, and the installation record is kept, marked removed.
• Deleting your account from the dashboard removes your Client IDs, sessions, sign-in codes, the scan and call records held for your account, saved cost reports, settings and report records. It keeps the quota ledger and the email-hash counters. They hold credit events and balances, an internal Client ID identifier or GitHub installation ID, a request trace ID, and a one-way hash of your email, with no scan content, and the counters stop a deleted account from resetting its monthly quota. Totals that name no account remain. GitHub App scan records are keyed to the installation, not the account; contact support@audytx.com to have them deleted.
• To request deletion of scan and call records for your installation, open a support ticket with your GitHub installation ID. We will delete within 7 days and confirm by reply.
• Deleted data can remain in Cloudflare's database recovery history for up to 30 days.

Data location

All processing runs on Cloudflare's global network. Scan records and account data are stored in a Cloudflare D1 database in the Asia-Pacific (APAC) region. Messages you send us and sign-up notices are delivered to staff mailboxes hosted by Google Workspace. No data is transferred to third-party analytics, advertising, or data-broker services. The providers that handle data for audytx are listed at /subprocessors.

Changes

Changes are posted on this page and the date above is updated on each revision. Account holders are emailed about material changes.

• 2026-10-02 — Changes section: now says what is done. Changes are posted here with the date; account holders are emailed about material ones. The fixed notice period was removed.
• 2026-10-02 — Cost Sampler: follow-up email is opt-in. The form has an unticked box, and the choice is deleted with the report. To stop, write to support@audytx.com.
• 2026-10-02 — Fonts are now served from audytx.com, so a page no longer asks Google for fonts. The sentence about fonts loaded from Google was removed.
• 2026-10-01 — Corrected what is stored, how long it is kept, where it is stored and who hosts it: accounts, contact form, Cost Sampler, findings, call metrics, operational logs and mailboxes.
• 2026-09-29 — CloudFormation named as scanned input.
• 2026-08-19 — MCP records described (audit and quota events).
• 2026-07-13 — Installation records added.