Security architecture and data handling
What audytx reads, what it stores and for how long, what the GitHub App is allowed to do, and how to report a security issue.
Does audytx store my Terraform or CloudFormation source code?
No. audytx fetches your Terraform files (.tf, .tf.json, .tfvars,
.tfvars.json) and CloudFormation templates, loads them into memory, analyzes them, and discards them.
No source file content is written to any database or log.
There's no build step, no clone, and no copy of your repository at rest anywhere in the service. The scan finishes and the source is gone.
What we store
Scan and call counts, installation and account records, and the quota ledger — enough to post the pull-request comment, show your dashboard and run the service. No source code, file contents, or secret values.
| Data | What is in it | Kept |
|---|---|---|
| Scan and call records | Account or installation identifier, tool and client names, outcome, timestamps, and counts of resources, files and findings by rule, severity and reasoning axis. Numbers and identifiers only: no finding text, file contents or secret values, and no personal data beyond the account identifier | Kept; your account's rows are deleted with the account, and only totals that name no account remain |
| Scan hand-off | The scan's request and result, passed to the analytics service through temporary object storage | Deleted as soon as it is processed |
| Installation records | Installation ID, account login and account type (user or organization), the installer's GitHub user ID, installed/removed/suspended timestamps | Kept; uninstalling marks the record removed |
| Accounts | Email, name, optional company email, GitHub user ID, plan, Client ID hashes, settings | Until you delete the account |
| Sessions | The session and its time; IP address and browser string | IP address and browser string cleared after 90 days |
| Sign-in codes | A keyed hash of the code | Deleted by the daily sweep once older than 24 hours |
| Quota ledger | Credit events and balances, an internal Client ID identifier or GitHub installation ID, a request trace ID, and a one-way hash of your email; no scan content | Kept, including after account deletion |
| Contact and abuse messages | Name, email, company and message | Kept; not deleted automatically |
| Cost Sampler reports | The email typed, whether you asked for follow-up email, savings and resource names | Deleted by the daily sweep once older than 5 days |
| Operational logs (Cloudflare) | Request records, audytx operational events and sampled traces | 7 days |
Never stored
Hardcoded secrets are never stored. When audytx flags one, the finding records where it is (resource, file path and line number), not the value — the secret is discarded with the rest of your source.
You control the lifetime
90-day clearing
The IP address and browser string recorded alongside older sign-in and activity records are cleared after 90 days, so what remains is the fact that something happened and when — not who it came from. Scan and call records hold numbers and identifiers only, and are kept until the account is deleted.
Uninstall stops access
Removing the GitHub App from your repository or organization stops audytx's access to it. It does not delete stored data: scan and call counts are kept, and the installation record is kept, marked removed.
Delete on request
Open a support ticket with your GitHub installation ID; we delete within 7 days and confirm by reply.
Delete your account
From the dashboard. It removes your Client IDs, sessions, sign-in codes, the scan and call records held for your account, saved cost reports and settings. It keeps the quota ledger and the email-hash counters: credit events and balances, an internal Client ID identifier or GitHub installation ID, a request trace ID, and a one-way hash of your email, with no scan content, and the counters stop a deleted account from resetting its monthly quota. Totals that name no account remain. GitHub App scan records are keyed to the installation, not the account; contact support@audytx.com to have them deleted.
Deleted data can remain in Cloudflare's database recovery history for up to 30 days.
What permissions does the audytx GitHub App need?
Contents is read-only: audytx can read your Terraform and CloudFormation files, and has no write access to your repository's code.
What it reads
Contents (read-only): your Terraform files and CloudFormation templates, through a
read-only mode only. Metadata (read-only): required by GitHub for every App.
Issues (read-only): to see the /audytx rescan comment.
All our servers are stateless. Once the files are fed through the engine, the serverless function stops and
your files are discarded by design.
What it writes back
Pull requests (read and write): the summary comment and review comments. Checks (read and write): the audytx check run and its Re-run button. Code scanning alerts (read and write): the Code Scanning (SARIF) upload. Never repository code.
Never requested
Write access to Contents. The App cannot push, modify, or delete your code.
MCP data handling
The same stateless model: file contents sent to POST /mcp are held in memory for
the duration of the call and are not stored by audytx. No request body is logged. If you ask an autofix tool
to open a pull request, the fixed files are committed to your repository with the token you supply.
What a call records
Accepted scan operations write immutable quota events, and each call adds one record of identifiers and counts (tool name, client name, outcome and counts). Scans store numbers only, as listed above. Non-scan helpers are free, and request bodies are never part of these records.
Client ID auth
IDs minted at /dashboard are SHA-256-hashed; only the hash plus an 8-character prefix are stored. The plaintext appears once at creation and you can revoke it at any time.
Autofix token
A GitHub token you pass to the autofix tools is shape-validated, confined to the single
owner/repo you name, used only for that request's GitHub API calls, then dropped.
The token is not retained in audytx's scan records or application logs. Recommended: a fine-grained personal access token scoped to only that
repository, with Contents: write + Pull requests: write — the exact
permission set GitHub requires for the git-data and pull-request endpoints this flow calls.
audytx keeps no server-side record of the push; the PR itself (branch audytx/autofix-*,
commit message naming the tool) is the attributable artifact in your repository.
Authentication and input validation are documented at /mcp/security. The written SSRF review is planned before the 1 November launch.
Who else touches your data
Beyond the providers that run the service, audytx hands your data to no third party.
Never handed off to
The MCP server only ever sees the Terraform or CloudFormation your coding agent sends it; the GitHub App reads from and writes to your own GitHub, the integration you chose to install. The dated list of subprocessors is at /subprocessors, and the terms that govern them are in our Data Processing Addendum.
Vulnerability disclosure policy
Found a security issue in audytx? Email support@audytx.com. Here's what happens next.
Please make a good-faith effort to avoid privacy violations, data destruction, and service degradation; only interact with accounts and installations you own; and do not exploit a finding beyond what is needed to demonstrate it.
If you make a good faith effort to comply with this policy during your security research, we will consider your research to be authorized, we will work with you to understand and resolve the issue quickly, and Rexstart Labs will not recommend or pursue legal action related to your research. Should legal action be initiated by a third party against you for activities that were conducted in accordance with this policy, we will make this authorization known.
This policy is machine-discoverable: we serve
/.well-known/security.txt (RFC 9116), whose Policy field
points here.
Common questions
Does audytx store my Terraform or CloudFormation source code?
No. Every scan is stateless: audytx fetches your Terraform files and CloudFormation templates via the GitHub Contents API, loads them into memory, analyzes them, and discards them. No source file content is written to any database or log.
What permissions does the audytx GitHub App need?
Contents is read-only. The App also has read and write access to pull requests, checks and code scanning alerts, and read-only access to issues and metadata, so it can post its comment and check run and upload Code Scanning results. It has no write access to your repository's code.
Does audytx have SOC 2 or ISO 27001 certification?
Not yet. We don't hold a SOC 2 or ISO 27001 certification. Until then, this page states what audytx stores and for how long.
Start free
Install the GitHub App, open a pull request, and read the findings. The Free plan includes 100 scans a month.