Trust & transparency

Last updated 9 August 2026 — written to be verified: every claim here is the system's actual behaviour, not an aspiration.

On this page — each heading is a permanent link, so a security reviewer can point at one answer.

• The short version
• 1. Neutrality — the measurer never sits at the table
• 2. What we access
• 3. Scan lifecycle
• 4. Where data lives
• 5. Who has access
• 6. Transport & perimeter
• 7. Subprocessors — the whole list
• 8. Data protection & the DPA
• 9. Compliance roadmap — the honest version
• 10. Responsible disclosure
• 11. Imprint

• Your source code is never written to disk — each scan clones it into volatile memory (RAM) and analyses it there; nothing about your source touches our SSDs. The working copy is deleted when the scan finishes, a recurring sweep removes anything a crashed run leaves behind once no running scan could still own it, and none of it survives a restart.
• No third-party AI ever sees your code — the LLM steps run on a model we host on our own hardware. Nothing is sent to OpenAI, Anthropic, Google or any other AI provider.
• Everything runs on hardware we own, located in Denmark (EU) — no cloud compute, no cloud storage, no CDN in the serving path.
• We do not train on your code — neither our own models nor anyone else's.
• Access mirrors GitHub — lose access on GitHub and you lose access to the reports here; memberships are re-synchronised daily.

Canine Development is never a delivering party on code it measures, and takes no success fees from suppliers. The rubric is identical regardless of which party pays — same dimensions, same thresholds, same scoring logic; the report doesn't know who holds the subscription. Both contracting parties being customers is the intended mode — one source of truth for both sides.

Paid support covers operating Watchdog — installation, CI integration, report interpretation — never engineering on codebases Watchdog measures. We sell the thermometer, never the patient's treatment.

The Watchdog GitHub App requests read-only Contents and Metadata by default — no actions, no webhook payloads with code, and we never modify your source. There is one optional write, off until you enable it: the audit-marker issue (requires issues:write), which maintains a single GitHub issue tracking open findings.

Sign-in is via GitHub through our self-hosted identity provider (Keycloak); we receive your GitHub login, display name and email.

Public GitLab projects can be added by URL (anonymous read-only clone; no token, no install). For code hosted elsewhere, a ZIP upload per scan is available — we extract it into the same RAM-backed workspace and analyse it there. Unlike a repository it cannot be fetched again, so it is not deleted at the end of the scan: it is removed after seven days without use, and is gone on a restart either way. See DPA annex C.4.

1. Clone — a temporary, isolated working copy.
2. Analyse — including the self-hosted model; your code never leaves our infrastructure.
3. Store results — the report bundle (HTML/Markdown/PDF), findings, scores, numeric metric points for trend graphs, and run metadata (timing, commit SHA, status) — not your source.
4. Delete — the clone is removed when the scan finishes, including on failure. An uploaded archive is the one exception: it has no remote to fetch from again, so it stays in RAM until seven days without use.

Reports may quote small code excerpts. Public reports pass through an additional sanitiser that strips account names and security-sensitive specifics.

All processing and storage happens on servers owned and operated by Canine Development, located in Denmark. There is no cloud provider in the data path — the analysis hosts, the database, report storage, the identity provider and the LLM are all self-hosted. Your data stays in the EU.

Storage is encrypted at rest. Database storage is encrypted at rest: production database volumes are encrypted using LUKS2 with AES-256 (XTS mode) full-disk encryption. Report artefacts are held on a separate LUKS2 volume using the same cipher, on its own disk, unlocked at boot from a key file with the break-glass key held off the machine.

• You and your team. Reports are visible to the repository's members; membership mirrors GitHub and is re-synchronised daily — revoked on GitHub means revoked here within a day.
• Public reports exist only for public repositories that are published: open-source repos on the free plan publish automatically — that is the pricing-page bargain; paid cohorts publish only by explicit opt-in.
• Least-privilege operations. Production access is restricted to named Canine Development operations personnel and logged. No contractors or third parties.

All public traffic is TLS-terminated at our own edge. Internal services are not internet-exposed — application and database listen on internal interfaces behind a host firewall. Sign-in is OIDC via self-hosted Keycloak brokering GitHub (no local passwords). Self-hosted scan ingestion (for self-hosted deployments) is token-authenticated per repository.

• Subprocessor
• Purpose
• Data
• Location
• Stripe Payments Europe, Limited (activates with billing)
• Payment processing
• Billing details
• Ireland — card data never touches our servers

That is the whole list — if you do not use billing we have no subprocessors at all. No analytics SaaS, no error-tracking SaaS, no CDN, no cloud AI. Identity (Keycloak), the engine, the LLM, the database and report storage are all self-hosted. We will update this page and email account owners before adding any subprocessor.

Your code host is not a subprocessor of ours. GitHub, GitLab or wherever else you keep your source is your own relationship, governed by the agreement you hold with it. Connecting a repository grants us read access to material you had already placed with your own supplier — we disclose no personal data to it, create nothing there, and never write to your repository. Its own terms, its own subprocessors and any transfers it makes sit outside our agreement with you. The binding version of this section is annex B of the DPA.

Source code may incidentally contain personal data; account data is processed to operate the service. Our standard Data Processing Agreement incorporates the subprocessor list; contact us for a countersigned copy.

Right to erasure is self-service — close your account from your settings. There is a 14-day reversible grace period; after it, we delete your personal data. Invoices are retained where bookkeeping law requires. See DPA §4.

Watchdog does not hold a SOC 2 attestation today, and we won't pretend otherwise. What we provide instead: this page as a factual control statement, the subprocessor list, a signable DPA, and EU-only processing on hardware we operate ourselves. A formal attestation (SOC 2 Type I or ISO 27001) is on the roadmap. Self-hosted deployments sidestep the question entirely — your code never leaves your network.

Report security issues to /contact?topic=security with reproduction steps. We acknowledge within 48 hours, keep you informed, and credit you if you want it. Please give us reasonable time to fix before publishing, and don't access other customers' data.

Canine Development — a registered company in Denmark. CVR: 42092134. Contact via the contact form. Responsible: the operator of watchdog.canine.dev.