Snapshot 230440
Normalized text
Scripts and page chrome removed; this is what change detection compares.
CodeAnt AI Product Resources Customers Enterprise Pricing Log in Book a demo CodeAnt AI Book a demo Product Review, secure and pentest every change, from PR to production. PRODUCT AI Pentesting Black-box and whitebox pentests that prove what is exploitable AI Code Reviews Line-by-line reviews on every pull request Code Security Platform SAST, SCA, secrets and IaC in one place Code Quality Platform Quality gates, coverage and dead code PLATFORM IDE Fix issues before you commit CLI Scan from any pipeline Integrations GitHub, GitLab, Bitbucket, Jira, Slack Azure DevOps Reviews and scans inside ADO Resources Docs, research and the team behind CodeAnt AI. RESOURCES Documentation Set up, configure and integrate Benchmark How CodeAnt compares on real repos Security Research CVEs and disclosures from our team Blogs Guides and engineering notes Vulnerability Database Search known vulnerabilities COMPANY About The team behind CodeAnt AI Trust Center Security, compliance and policies White Paper Continuous cyber defense, in depth Customers Enterprise Pricing Log in Book a demo CodeAnt AI Book a demo Product Review, secure and pentest every change, from PR to production. PRODUCT AI Pentesting Black-box and whitebox pentests that prove what is exploitable AI Code Reviews Line-by-line reviews on every pull request Code Security Platform SAST, SCA, secrets and IaC in one place Code Quality Platform Quality gates, coverage and dead code PLATFORM IDE Fix issues before you commit CLI Scan from any pipeline Integrations GitHub, GitLab, Bitbucket, Jira, Slack Azure DevOps Reviews and scans inside ADO Resources Docs, research and the team behind CodeAnt AI. RESOURCES Documentation Set up, configure and integrate Benchmark How CodeAnt compares on real repos Security Research CVEs and disclosures from our team Blogs Guides and engineering notes Vulnerability Database Search known vulnerabilities COMPANY About The team behind CodeAnt AI Trust Center Security, compliance and policies White Paper Continuous cyber defense, in depth Customers Enterprise Pricing Log in Book a demo Privacy Policy 1Who we are and when this Policy applies2Information we collect3Our privacy commitments4How and why we use information5Customer Data and AI6Cookies, analytics and advertising7When we disclose information8Retention9International processing10Security11Your rights and choices12Additional disclosures for US state residents13Children, other services, changes and contact Terms of Service Data Processing Agreement LEGAL CodeAnt AI Privacy Policy Effective date: November 6, 2026 1Who we are and when this Policy applies2Information we collect3Our privacy commitments4How and why we use information5Customer Data and AI6Cookies, analytics and advertising7When we disclose information8Retention9International processing10Security11Your rights and choices12Additional disclosures for US state residents13Children, other services, changes and contact This Privacy Policy explains how CodeAnt AI, Inc. collects, uses, discloses and protects personal information, and the rights and choices you have. As a security company, we hold ourselves to strict data minimization: we collect only what we need, never train AI models on your data, and delete what we no longer need. Our commitments are set out in Section 3. 1. Who we are and when this Policy applies CodeAnt AI, Inc. (“CodeAnt AI”, “we”, “us”) is a Delaware corporation that provides an autonomous preventive security platform: AI code reviews, code quality, code security (SAST, SCA, secrets and infrastructure-as-code scanning), penetration testing and attack surface monitoring (the “Services”). Where we are the controller. This Policy covers personal information we handle for our own purposes: when you visit codeant.ai and our other websites, create or administer an account, buy from us, attend our events, communicate with us, or are a business contact. Where we act for our customers. Customers give us access to source code, repositories, cloud configurations, systems to test, and the findings and reports we produce (“Customer Data”). When Customer Data contains personal information, we process it as a processor or service provider on the customer’s instructions, under the customer’s agreement and our Data Processing Agreement at codeant.ai/dpa. This Policy gives us no additional rights to use Customer Data. If your information is in an organization’s Customer Data, please contact that organization first; we will help it respond. Self-hosted deployments. When a customer runs CodeAnt AI inside its own cloud or data center, Customer Data stays in that environment and we do not receive it, apart from anything the customer chooses to share with us, such as a support request. Contact. CodeAnt AI, Inc., 355 Bryant St., Unit 403, San Francisco, CA 94107, USA. Email security@codeant.ai with the subject line “Privacy request”. 2. Information we collect What we collect depends on how you interact with us. Category What it includes Where it comes from Account and contact Name, business email, company, job title, role, phone number if provided, account and workspace identifiers You, or your organization’s administrator Authentication and integrations Git provider username, user ID, email and avatar; organization and repository names and permissions; access tokens for GitHub, GitLab, Bitbucket, Azure DevOps, Jira, Slack or cloud accounts you connect The provider, when you or your administrator authorize the connection. We never receive your Git provider password. Tokens are stored encrypted and used only for the actions you authorize. Billing Billing contact, billing address, tax ID, purchase and invoice history; card brand, last four digits and expiry You and Stripe. Full card numbers are collected by Stripe, not by CodeAnt AI. Communications Emails, support tickets, website chat and AI assistant conversations, survey responses, and call recordings or transcripts when we tell you a call is recorded You Website and product usage IP address, device and browser type, pages viewed, referring URL, clicks and scrolls, session recordings, approximate location derived from IP address, features used, errors Automatically, through cookies and similar technologies (Section 6) Security and audit logs Sign-in events, IP addresses, administrator actions, API calls Automatically, when you use the Services Events and partners Name, company, title and email from badge scans or event forms; domains you submit for an attack surface report; referrals You, event organizers, and channel or technology partners Business contact data from others Name, title, company, business email and phone, professional profile, company industry and size Commercial business data providers, public professional profiles, public business records, and company-level identification of website visitors (Section 6) Please do not send us sensitive information, such as health data or government ID numbers, in support or sales messages unless we ask for it. 3. Our privacy commitments We are a security company, and we treat your data the way we ask our customers to treat theirs. These commitments apply across our websites and Services. 1. We collect only what we need. We collect personal information only for the purposes in this Policy, and nothing more. We do not collect government ID numbers, precise location, biometric data or health information for our own purposes, and we never ask for passwords to your other accounts. 2. We do not store your source code. Code is analyzed in isolated, ephemeral environments and deleted, together with the abstract syntax trees built from it, when each scan or review completes. 3. We never train AI models on your data. We do not use Customer Data, or personal information we collect, to train, fine-tune or otherwise improve any AI model, ours or a third party’s. Our model providers are contractually prohibited from doing so. 4. We never sell Customer Data. Customer Data is never used for advertising or marketing and is never shared with advertising partners. 5. We keep only the evidence we need. Findings and reports contain only what is needed to prove and fix each issue. Integration tokens are encrypted and used only for the actions you authorize. 6. Access is limited. Our personnel access Customer Data only to provide support you request or to keep the Services secure, under least-privilege controls reviewed at least quarterly. 7. We delete on a schedule. Every category of data has a fixed retention period (Section 8), and we delete or de-identify it when that period ends. 8. You stay in control. Customers choose where their data is processed, can run CodeAnt AI inside their own environment, and can have their data deleted at any time. 4. How and why we use information We use personal information for the purposes below. If you are in the European Economic Area, the United Kingdom or Switzerland, the right column shows the legal basis we rely on. Purpose Examples Legal basis (EEA, UK, Switzerland) Provide the Services and your account Create accounts, connect integrations, run reviews, scans and tests, deliver reports Contract with you. For users on a customer’s account, our legitimate interest in delivering the service that customer bought. Billing and administration Invoices, payments, renewals, tax records Contract; legal obligation Support and service messages Answer requests; send security, account and transaction notices Contract; legitimate interests Security and abuse prevention Monitor sign-ins, detect misuse, protect our systems, keep audit logs Legitimate interests; legal obligation Improve our websites and Services Analytics, session replay, debugging, product development Legitimate interests; consent where required for non-essential cookies Sales and marketing Emails about products and events, demos, follow-ups, event outreach Legitimate interest in business communications; consent where required by electronic marketing law Advertising and measurement Show our ads on other platforms and measure campaigns Consent in the EEA, UK and Switzerland; opt-out elsewhere (Section 6) Legal and compliance Respond to lawful requests, enforce our terms, establish or defend claims Legal obligation; legitimate interests Where we rely on legitimate interests, we have weighed them against your rights, and you may object (Section 11). Where we rely on consent, you can withdraw it at any time without affecting earlier processing. If information is required to provide something you asked for, we will tell you, and without it we may be unable to provide it. You can unsubscribe from marketing emails using the link in any message or by emailing us. We will still send necessary account, security and transaction messages. 5. Customer Data and AI We process Customer Data only to deliver the Services the customer requests, under its agreement and our DPA. What Customer Data includes. Source code, pull request diffs and context, repository metadata (including commit authors and contributor names, usernames and emails), configuration and infrastructure-as-code files, cloud configurations, scan and test results, penetration test evidence, and custom review prompts and learnings. How source code is handled. For each scan or review, the repository is cloned into an isolated, ephemeral environment that exists only for that job. Raw source code and the abstract syntax trees we build from it are deleted when the job completes. We keep what the customer needs to act: findings with the file, line and context needed to explain each issue, reports, review comments, metrics and configuration. AI models. We use large language models from third-party providers, and models we operate ourselves, to produce reviews, fixes and analyses. Our model providers are contractually prohibited from training on Customer Data, and we use provider settings that do not retain prompts or outputs. The providers we use are listed with our other subprocessors (Section 7). No training on Customer Data. We do not use Customer Data to train, fine-tune or otherwise improve any AI model, ours or a third party’s. Running a model to produce an analysis the customer requested is not training. Region and deployment choices. Customers can choose the region where Customer Data is processed. Enterprise customers can deploy CodeAnt AI inside their own cloud or data center so Customer Data never leaves their environment. Retention and deletion. Customer Data is kept for the term of the customer’s agreement, then returned or deleted within 90 days, as set out in our DPA. 6. Cookies, analytics and advertising Our websites use cookies and similar technologies for three purposes: Essential: running the site, keeping you signed in, remembering your privacy choices and protecting against attacks. Analytics: understanding how our websites and Services are used so we can improve them. Any recording of page interactions masks passwords and form inputs. Marketing: measuring our advertising and understanding which organizations visit our websites. Your choices: EEA, UK and Switzerland. We ask for your consent before setting non-essential cookies. You can change your choice at any time through Cookie Settings in our website footer. United States. Our advertising and company identification technologies may count as “selling” or “sharing” personal information, or as “targeted advertising”, under some state privacy laws. We do not sell personal information for money. You can opt out through Your Privacy Choices in our website footer, or by enabling Global Privacy Control (GPC) in your browser. We treat a GPC signal as a valid opt-out for that browser, and for any account linked to it when we know of the link. Everywhere. You can block or delete cookies in your browser settings, and manage ad preferences in the settings of the platforms where you see our ads. Blocking some cookies may affect how the site works. There is no common standard for browser Do Not Track signals, so we do not respond to them. We do honor GPC as described above. 7. When we disclose information We disclose personal information only to the recipients below, and only as needed for the purposes in this Policy. Recipient Why Examples Service providers Hosting, AI inference, CRM and email, support, analytics, payments and collaboration, under contracts that limit their use of the data Amazon Web Services, Google Cloud, Microsoft Azure, AI model providers, HubSpot, Google Workspace, Loops, Slack, Intercom, Pylon, PostHog, Amplitude, Stripe, Trello, GitHub Advertising and identification partners The purposes in Section 6. These partners may also use the data under their own privacy policies. They never receive Customer Data. Advertising platforms and business data providers Your organization Administrators of your workspace can see users, activity and results Your workspace administrators Partners in your purchase Resellers, channel and referral partners involved in your purchase or deployment As applicable to your deal Advisers and auditors Legal, accounting, and SOC 2 and HIPAA audits Law firms, accountants, auditors Authorities To comply with law or valid legal process, or to protect rights, safety and security Courts, regulators, law enforcement, where required Corporate transactions A merger, financing, acquisition or sale of assets, under confidentiality Prospective acquirers or investors We also disclose information when you direct us to or consent. Stripe acts as an independent controller for some processing, such as fraud prevention and its legal obligations. Apart from the partners in Section 6, which you can opt out of, we do not disclose personal information to third parties for their own marketing. Customer Data is disclosed only as the customer’s agreement and our DPA allow. Our current subprocessors are listed at codeantai.trust.site/subprocessors, and we give customers 30 days’ notice before adding one. 8. Retention We keep personal information only as long as needed for the purposes in this Policy, then delete or de-identify it. Information How long we keep it Source code and abstract syntax trees Never stored. Deleted when each scan or review completes. Findings, reports, penetration test evidence, custom prompts Term of the customer agreement, then returned or deleted within 90 days Account and profile Life of the account, then deleted or de-identified within 30 days of closure Billing and tax records 7 years after the transaction, as tax law requires Support and chat conversations 2 years after the last message Sales and marketing records Until you opt out, or 2 years after your last engagement. We keep a minimal suppression record so we can honor your opt-out. Website and product analytics Up to 14 months Session recordings Up to 30 days Security and audit logs 12 months Backups Overwritten within 35 days We may keep information longer when the law requires it or to resolve a dispute, limited to that purpose and protected while kept. De-identified information we keep cannot reasonably be linked to you; removing a name alone does not make information de-identified. 9. International processing CodeAnt AI is based in the United States. Our personnel and service providers process data in the United States, the United Kingdom and India, and in the EEA when a customer selects an EEA region. When we transfer personal information out of the EEA, the UK or Switzerland, we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or the Swiss equivalent, together with supplementary measures such as encryption and strict access controls. You can ask us for a copy of the safeguards that apply to your information. We do not treat your use of our Services as consent to international transfers. 10. Security CodeAnt AI holds a SOC 2 Type II report and maintains a HIPAA compliance program. Our safeguards include: Encryption of data in transit with TLS, and at rest. Isolated, ephemeral environments for every code scan. Least-privilege access, reviewed at least quarterly, with multi-factor authentication for remote access. Regular external vulnerability assessments and penetration tests of our own platform. Incident response plans, annual security training and, where lawful, background checks for staff. Customers can request our audit reports through our Trust Center under a nondisclosure agreement. No system is perfectly secure, and a certification covers only its stated scope. Please keep your credentials safe and tell us right away if you think your account is compromised. To report a vulnerability in our products, email security@codeant.ai. If a breach affects your personal information, we will notify you and authorities as the law requires. 11. Your rights and choices Depending on where you live, you may have the right to: Know what personal information we hold about you and get a copy, including in a portable format. Correct inaccurate information. Delete your information. Restrict or object to our processing, including processing based on legitimate interests. You can object to direct marketing at any time. Withdraw consent you have given. Opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. Appeal our decision on your request. Complain to your data protection authority or privacy regulator. How to make a request. Email security@codeant.ai with the subject “Privacy request”. For advertising and identification opt-outs, use Your Privacy Choices in our website footer or enable GPC. We will verify your request by matching it to information we hold, for example by confirming you control the email address on file. An authorized agent may act for you with your signed permission, and we may confirm directly with you. We respond within the time the law allows: one month under the GDPR and UK GDPR, and 45 days under US state laws, each extendable where the law permits. If we decline a request, we will explain why. Where you have a right to appeal, reply to our decision with “Appeal” in the subject; if we deny the appeal, you may contact your state attorney general. We will not discriminate against you for exercising your rights. If your request concerns Customer Data we process for an organization, we will pass it to that organization and assist it as required. We do not make decisions based solely on automated processing that produce legal or similarly significant effects about you. India. Where the Digital Personal Data Protection Act, 2023 applies, you may raise grievances with us at the email above, and if unresolved, with the Data Protection Board of India. 12. Additional disclosures for US state residents This section, read with the rest of this Policy, is our notice at collection under the California Consumer Privacy Act and similar state laws. In the past 12 months we collected the categories below. Sources and purposes are described in Sections 2 to 4, and retention in Section 8. Category Examples Disclosed for a business purpose to Sold or shared for targeted advertising? Identifiers Name, email, phone, IP address, account and cookie IDs Service providers, advertising and identification partners Yes: cookie IDs and IP addresses, with advertising and identification partners Customer records Name, billing address, phone Service providers No Commercial information Purchases, subscriptions, invoices Service providers No Internet or network activity Pages viewed, clicks, session recordings, product usage, logs Service providers, advertising and identification partners Yes: website activity, with advertising and identification partners Approximate geolocation City or region derived from IP address Service providers, advertising partners Yes: as part of IP address data Audio and electronic information Call recordings, chat transcripts Service providers No Professional information Job title, employer, company industry and size Service providers, identification partners Yes: company-level data, with identification partners We do not sell personal information for money. We do not knowingly sell or share personal information of anyone under 16. We do not collect or use sensitive personal information to infer characteristics about you, or for any purpose that would give you a right to limit its use. We do not offer financial incentives in exchange for personal information. To opt out of selling or sharing, use Your Privacy Choices in our website footer or enable GPC. California residents may also ask about disclosures of personal information to third parties for their direct marketing purposes by emailing security@codeant.ai. 13. Children, other services, changes and contact Children. Our Services are for businesses and are not directed to children under 16. We do not knowingly collect personal information from children under 16 for our own purposes. If you believe a child has given us personal information, contact us and we will delete it. Customer Data is handled under the customer’s instructions, and this statement does not reduce protections for data we receive incidentally. Other services. Third-party websites and services linked from ours, including integrations you connect, have their own privacy policies, which apply when they decide how to use your information. Changes. We may update this Policy as our practices or the law change. We will update the effective date and, for material changes, notify you by email or in the product before they take effect. Where a new use requires your consent, we will ask for it first; continuing to use the Services does not count as consent. Contact. CodeAnt AI, Inc., 355 Bryant St., Unit 403, San Francisco, CA 94107, USA. Email security@codeant.ai with the subject “Privacy request”. Ship clean & secure code faster Start free trial Get pentest report CodeAnt AI 355 Bryant St, San Francisco, CA 94107 All systems normal Product AI Pentesting AI Code Review Code Security Code Quality Developer 360 Company About Pricing Customer Story Blogs Glossary Enterprise Contact Sales Developers Documentation Integrations Security Research Vulnerability Data System Status © 2026 CodeAnt AI. All rights reserved. DPA Terms and Conditions Privacy Policy Trust Center EU AI Act Policy Report a Vulnerability CodeAnt AI 355 Bryant St, San Francisco, CA 94107 All systems normal Product AI Pentesting AI Code Review Code Security Code Quality Developer 360 Company About Pricing Customer Story Blogs Glossary Enterprise Contact Sales Developers Documentation Integrations Security Research Vulnerability Data System Status © 2026 CodeAnt AI. All rights reserved. DPA Terms and Conditions Privacy Policy Trust Center EU AI Act Policy Report a Vulnerability CodeAnt AI 355 Bryant St, San Francisco, CA 94107 All systems normal Product AI Pentesting AI Code Review Code Security Code Quality Developer 360 Company About Pricing Customer Story Blogs Glossary Enterprise Contact Sales Developers Documentation Integrations Security Research Vulnerability Data System Status © 2026 CodeAnt AI. All rights reserved. DPA Terms and Conditions Privacy Policy Trust Center EU AI Act Policy Report a Vulnerability