Privacy
Privacy notice for NEXT Code Guard.
Which data Code Guard processes, where it goes, how long it stays and which rights you have. For your repositories TOMORIS acts as a processor under the data processing agreement in part C of the terms.
As of
Controller and roles
TOMORIS GmbH, Saturnstraße 1, 4614 Marchtrenk, Austria, e-mail [email protected], phone +43 7243 53091.
For visiting this website, signing in, buying and invoicing, TOMORIS is the controller. For the content of your repositories your company is the controller and TOMORIS the processor (Art. 28 GDPR, terms part C).
Visiting the website
The website runs on servers of TOMORIS GmbH in Austria. The way there passes Cloudflare, which encrypts the connection and fends off attacks. Technically necessary data arises: IP address, time, requested address, browser identifier and status code. It serves operation and security only (Art. 6(1)(f) GDPR) and is kept only as long as that requires.
Code Guard loads no fonts, scripts or images from other providers, except the preview image of tomoris.com for shared links. There are no analytics and no advertising cookies.
Cookies and browser storage
Only technically necessary cookies: the sign-in cookie (at most 8 hours, HTTPS only, not readable by scripts), a short-lived cookie that secures the sign-in with GitHub, and a protection cookie against forged forms.
Your choice of colour mode is stored locally by the browser. If you come from an ad, the browser keeps the click id until you close the tab (see ad measurement).
Sign-in with GitHub
You sign in with your GitHub account. GitHub tells us your id, your login and the installations of the Code Guard app you can access. From that, Code Guard decides which organisations you may see (Art. 6(1)(b) GDPR). Access tokens from GitHub are not stored.
Checking your repositories
The GitHub App only reads, and only the repositories you choose: contents, metadata, checks and Dependabot alerts. For a run a repository is cloned into a folder of its own that only the service account can read, and deleted when the run ends.
Findings are stored without code: repository, commit, path, lines, rule, severity, title, description and recommendation. Source code, clones, installation and user tokens are not stored. The code view in the dashboard reads the excerpt live and does not cache it.
Personal data can be part of code, such as names and e-mail addresses in commits. It is processed only as part of the check.
AI review
For the AI review of changes and the architecture review, excerpts go to the language model Claude by Anthropic: for the scan the changes since the last run (at most 60 KB per repository), for the review parts of the repository (at most 80,000 tokens per part). Secrets are redacted first.
Code goes to Anthropic only through an access with zero data retention: Anthropic stores neither request nor answer. If that access is not confirmed, Code Guard sends nothing to a model for your organisation, and the report says "not measured". Processing takes place in the USA; the transfer relies on the standard contractual clauses of the EU Commission.
Trial, purchase and invoice
For trial and subscription Code Guard passes to TOMORIS Commerce, our own billing service: the id of your installation, the chosen plan, the e-mail address for invoice and trial and the country of the company seat. You enter payment details directly at Stripe; TOMORIS never sees full card data.
TOMORIS creates invoices in Microsoft Dynamics 365 Business Central and sends them by e-mail through Microsoft 365. The basis is the contract (Art. 6(1)(b) GDPR) and the legal retention duty (§ 132 BAO, Art. 6(1)(c) GDPR).
Ad measurement
If you come from a Google ad, the address carries a click id (gclid, gbraid or wbraid). Code Guard passes it on with the install link to GitHub, gets it back after the installation and stores it with your organisation in the event log, together with the events "trial started" and "purchase". This shows us whether an ad led to a trial or a purchase (Art. 6(1)(f) GDPR).
Code Guard loads no measurement or advertising scripts from Google today, and nothing is sent to Google. Should that change, it happens only with your consent, and this notice is updated first.
Recipients and sub-processors
| Company | Purpose | Data | Location |
|---|---|---|---|
| TOMORIS GmbH, own servers | Running Code Guard, database, runs | all of the above | Austria |
| Anthropic Ireland, Limited and Anthropic, PBC | AI review (Claude), zero data retention | code excerpts after secrets are redacted | USA |
| Cloudflare, Inc. | Delivery, encryption, protection against attacks | connection data, content in transit | worldwide, headquartered in the USA |
| Stripe Payments Europe, Limited | Payment at checkout | e-mail, payment data | Ireland, processing in the USA possible |
| Microsoft Ireland Operations Limited | Invoice (Business Central) and invoice e-mail (Microsoft 365) | invoice data, e-mail address | EU |
| GitHub, Inc. | Source of your repositories and sign-in | nothing passed on by Code Guard | USA |
GitHub is no sub-processor: you use GitHub yourself, and Code Guard accesses it through the app you install. Transfers to the USA rely on the EU-US Data Privacy Framework or the standard contractual clauses of the EU Commission. We inform customers about new sub-processors at least 30 days in advance (terms part C).
Retention
Organisation (installation, GitHub account, status, budgets): until 90 days after the uninstall. Repositories, reviewed commits, coverage and the entitlement from Commerce: as long as the organisation. Open findings while they are reported; resolved findings 12 months. Runs with time, status and cost and the event log: 24 months. Invoices: 7 years.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Write to [email protected]. You can lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.