Security architecture, verifiable claim by claim
No compliance theater. Every claim on this page is backed by the code that implements it — if a claim can't be verified against the codebase, it doesn't appear here.
Does audytx store my Terraform source code?
No. audytx fetches your .tf and .tfvars files, loads them into memory,
analyzes them, and discards them. No source file content is written to any database or log.
There's no build step, no clone, and no copy of your repository at rest anywhere in the service. The scan finishes and the source is gone.
What we store
One small metadata row per scan — just enough to post the pull-request comment and run the service. No source code, file contents, or secret values ever land in it.
Stored — scan & installation metadata
Never stored
Hardcoded secrets are never stored. When audytx flags one, the finding records the file path and line number only — the secret value is discarded with the rest of your source.
You control the lifetime
90-day auto-delete
Scan metadata records are retained for 90 days, then automatically deleted. On the same 90-day schedule, the IP address and browser string recorded alongside older sign-in and activity records are cleared, so what remains is the fact that something happened and when — not who it came from.
Uninstall = instant revoke
Removing the GitHub App from your repository or organization immediately and permanently revokes audytx's access — no separate deletion request needed.
Delete on request
Open a support ticket with your GitHub installation ID; we delete within 7 days and confirm by reply.
What permissions does the audytx GitHub App need?
A fine-grained, read-only contents permission — audytx can read your Terraform, and
can never push, modify, or delete code.
What it reads
Your .tf and .tfvars files, through a read-only mode only.
All our servers are stateless. Once the files are fed through the engine, the serverless function stops and all your files gets discarded by design.
What it writes back
Only the pull-request comment and review comments, a check-run status, and the Code Scanning (SARIF) upload — never repository code.
Never granted
The legacy OAuth repo scope — GitHub's own "read and write access to code". A read-only
contents permission can't do that; the write capability is never granted in the first place.
MCP data handling
The same stateless model: file contents sent to POST /mcp are held in memory for
the duration of the call and written nowhere. No request body is logged.
Metered, not recorded
Successful tool calls increment a monthly counter and write a usage-event record — tool name, account and token identifiers, client IP. Request content is never part of it.
Client ID auth
IDs minted at /dashboard are SHA-256-hashed; only the hash plus an 8-character prefix are stored. The plaintext appears once at creation and you can revoke it at any time.
Autofix token
A GitHub token you pass to the autofix tools is shape-validated, confined to the single
owner/repo you name, used only for that request's GitHub API calls, then dropped.
It's never logged and never stored — a contract pinned by an automated test over every module
the token transits. Recommended: a fine-grained personal access token scoped to only that
repository, with Contents: write + Pull requests: write — the exact
permission set GitHub requires for the git-data and pull-request endpoints this flow calls.
audytx keeps no server-side record of the push; the PR itself (branch audytx/autofix-*,
commit message naming the tool) is the attributable artifact in your repository.
The full MCP security posture — authentication, input validation, SSRF audit — is documented at /mcp/security.
Who else touches your data
Almost no one. Beyond the infrastructure that runs the service, audytx hands your data to no third party.
Never handed off to
The MCP server only ever sees the Terraform your coding agent sends it; the GitHub App reads from and writes to your own GitHub, the integration you chose to install. The full, dated list of subprocessors is at /subprocessors, and the terms that govern them are in our Data Processing Addendum.
Vulnerability disclosure policy
Found a security issue in audytx? Email security@audytx.com. Here's what happens next.
Please make a good-faith effort to avoid privacy violations, data destruction, and service degradation; only interact with accounts and installations you own; and do not exploit a finding beyond what is needed to demonstrate it.
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Rexstart Labs will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.
This policy is machine-discoverable: we serve
/.well-known/security.txt (RFC 9116), whose Policy field
points here.
Common questions
Does audytx store my Terraform source code?
No. Every scan is stateless: audytx fetches your .tf and .tfvars files via
the GitHub Contents API, loads them into memory, analyzes them, and discards them. No
source file content is written to any database or log.
What permissions does the audytx GitHub App need?
A read-only contents permission. audytx installs as a GitHub App with fine-grained
permissions: it can read your Terraform files but can never push, modify, or delete code. The only
writes it makes to GitHub are the pull-request comment and review, a check-run status, and the Code
Scanning (SARIF) upload.
Does audytx have SOC 2 or ISO 27001 certification?
Not yet. We don't yet hold a SOC 2 or ISO 27001 certification; formal certification comes when customer demand calls for it. Until then, this page offers something a badge can't: a security architecture you can verify against the source, claim by claim.
Start free during the open beta
Install the GitHub App, open a pull request, and read a verdict backed by the architecture on this page — no source stored, read-only access, metadata you control.