Security & data handling

Last reviewed 22 September 2026. Written to be verified: every claim here is the system's actual behaviour, not an aspiration. Where the posture is weaker than we would like, §5 says so rather than leaving it for your review to find.

On this page. Each heading is a permanent link, so a security reviewer can point at one answer.

• The short version
• 1. Neutrality: who we will not work for
• 2. What we access
• 3. Survey lifecycle
• 4. Where data lives
• 5. Concentration: one site, and what happens if it fails
• 6. Who has access
• 7. Transport and perimeter
• 8. Subprocessors: the whole list
• 9. Data protection and the DPA
• 10. Compliance roadmap, including what we do not hold
• 11. Responsible disclosure
• 12. Imprint

• Your source code is never written to disk. Each survey clones it into volatile memory (RAM) and analyses it there, so nothing about your source touches our SSDs. The working copy is deleted when the survey finishes, a recurring sweep removes anything a crashed run leaves behind once no running survey could still own it, and none of it survives a restart.
• No third-party AI ever sees your code. The LLM steps run on a model we host on our own hardware. Nothing is sent to OpenAI, Anthropic, Google or any other AI provider.
• Everything runs on hardware we own, located in Denmark (EU). No cloud compute, no cloud storage, no CDN in the serving path.
• We do not train on your code, neither our own models nor anyone else's.
• On GitHub, access mirrors GitHub. Lose access there and you lose access to the reports here, re-synchronised daily. On GitLab, Bitbucket and Azure DevOps we cannot read who has access, so that mirror does not exist: access is whatever your Watchdog team and grants say, until somebody changes it here. §6 says what that means in practice.

Canine Development is never a delivering party on code it measures, and takes no success fees from suppliers. The rubric is identical regardless of which party pays, with the same dimensions, thresholds and scoring logic, and the report doesn't know who holds the subscription. Both contracting parties being customers is the intended mode, giving one source of truth for both sides.

Paid support covers operating Watchdog, meaning installation, CI integration and report interpretation, and never engineering on codebases Watchdog measures.

How we reach your code depends on where it is, and in every case it is read access only: we never modify your source and we receive no webhook payloads containing code.

• GitHub. The Watchdog GitHub App, requesting read-only Contents and Metadata. You choose which repositories the installation can see.
• GitLab and Bitbucket. You authorise Watchdog and we hold the resulting read-scoped access token. It reaches exactly what your own account reaches, and nothing else.
• Azure DevOps. A Personal Access Token you paste, scoped to one organisation and needing only Code (read). We check it can list repositories before storing it, so a token that cannot work is refused at the form rather than discovered later as a failed survey.
• Any of the four, public repositories. Addable by URL with no token and no installation, cloned anonymously.

There is one optional write on GitHub, off until you enable it: the audit-marker issue (requires issues:write), which maintains a single GitHub issue tracking open findings.

Sign-in goes through our self-hosted identity provider (Keycloak), which brokers GitHub and GitLab, and we receive your login, display name and email. Signing in is not what grants access to a repository, because the two are separate. You can sign in with GitHub and survey an Azure DevOps repository, since the credential that reads the code belongs to the connection rather than to your login.

For code that is on none of those four hosts, a ZIP upload per survey is available. We extract it into the same RAM-backed workspace and analyse it there. Unlike a repository it cannot be fetched again, so it is not deleted at the end of the survey: it is removed after seven days without use, and is gone on a restart either way. See DPA annex C.4.

1. Clone. A temporary, isolated working copy.
2. Analyse. Including the self-hosted model, and your code never leaves our infrastructure.
3. Store results. The report bundle (HTML, Markdown, PDF), findings, scores, numeric metric points for trend graphs, and run metadata such as timing, commit SHA and status. Not your source.
4. Delete. The clone is removed when the survey finishes, including on failure. An uploaded archive is the one exception: it has no remote to fetch from again, so it stays in RAM until seven days without use.

Reports may quote small code excerpts. Public reports pass through an additional sanitiser that strips account names and security-sensitive specifics.

All processing and storage happens on servers owned and operated by Canine Development, located in Denmark. There is no cloud provider in the data path: the analysis hosts, the database, report storage, the identity provider and the LLM are all self-hosted. Your data stays in the EU.

Storage is encrypted at rest. Production database volumes are encrypted using LUKS2 with AES-256 (XTS mode) full-disk encryption. Report artefacts are held on a separate LUKS2 volume using the same cipher, on its own disk, unlocked at boot from a key file with the break-glass key held off the machine.

• You and your team. Reports are visible to the repository's members, meaning the team that holds it plus any per-person exceptions granted in Watchdog.
• Revocation mirrors the code host on GitHub, and only there. For a GitHub repository, membership is re-synchronised daily, so revoked on GitHub means revoked here within a day. On GitLab, Bitbucket and Azure DevOps the read-scoped credential we hold cannot list who else has access, so nothing is mirrored, and removing somebody on the host does not remove them here. Remove them from the team, or from Access exceptions, and it takes effect immediately.
• Public reports exist only for public repositories that are published: the open-source corpus we survey on our own account, and reports whose owners publish them by explicit opt-in, on any plan. No plan publishes your reports automatically.
• Least-privilege operations. Production access is restricted to named Canine Development operations personnel and logged. No contractors or third parties.

All public traffic is TLS-terminated at our own edge. Internal services are not internet-exposed, and application and database listen on internal interfaces behind a host firewall. Sign-in is OIDC via self-hosted Keycloak brokering GitHub and GitLab, with no local passwords. Self-hosted survey ingestion, for self-hosted deployments, is token-authenticated per repository.

• Subprocessor
• Purpose
• Data
• Location
• Stripe Payments Europe, Limited (activates with billing)
• Payment processing
• Billing details
• Ireland. Card data never touches our servers

That is the whole list, so if you do not use billing we have no subprocessors at all. No analytics SaaS, no error-tracking SaaS, no CDN, no cloud AI. Identity (Keycloak), the engine, the LLM, the database and report storage are all self-hosted. We will update this page and email account owners before adding any subprocessor.

Your code host is not a subprocessor of ours. GitHub, GitLab or wherever else you keep your source is your own relationship, governed by the agreement you hold with it. Connecting a repository grants us read access to material you had already placed with your own supplier, and we disclose no personal data to it, create nothing there, and never write to your repository. Its own terms, its own subprocessors and any transfers it makes sit outside our agreement with you. The binding version of this section is annex B of the DPA.

Source code may incidentally contain personal data, and account data is processed to operate the service. Our standard Data Processing Agreement incorporates the subprocessor list. Contact us for a countersigned copy.

Right to erasure is self-service. Close your account from your settings. There is a 14-day reversible grace period, after which we delete your personal data. Invoices are retained where bookkeeping law requires. See DPA §4.

Watchdog does not hold a SOC 2 attestation today, and we won't pretend otherwise. What we provide instead: this page as a factual control statement, the subprocessor list, a signable DPA, and EU-only processing on hardware we operate ourselves. A formal attestation (SOC 2 Type I or ISO 27001) is on the roadmap. Self-hosted deployments sidestep the question entirely, because your code never leaves your network.

Report security issues via the contact form with reproduction steps. We acknowledge within 48 hours, keep you informed, and credit you if you want it. Please give us reasonable time to fix before publishing, and don't access other customers' data.

Canine Development, a registered company in Denmark. CVR: 42092134. Contact via the contact form. Responsible: the operator of watchdog.canine.dev.