Skip to main content
Detail processes sensitive code, e.g. for banks, healthcare systems, and defense applications, so it’s critical that we can do so in a way that merits customer trust. Protecting your source code is a core design constraint of our platform. This page explains how your code is accessed, processed, stored, and safeguarded.

​
Access is scoped and controlled by you

Detail connects to your repositories through a GitHub App, so access is governed by GitHub’s permission model. You select exactly which repositories Detail can see, and you can revoke access at any time from your GitHub settings. For details on the exact read and write permissions Detail requests, see Connect GitHub repositories to Detail.

​
Your code is processed in isolated, ephemeral environments

When Detail investigates a potential bug, it checks out your code into an isolated, sandboxed development environment. Your code is never commingled with other customers’ code, and different sandboxes are isolated from each other at the network layer. These environments are ephemeral and are destroyed after analysis. Environment snapshots, which include customer code, are retained for up to 30 days, then deleted. Customer data is encrypted in transit and at rest.

​
Your code is never used to train models that could reproduce it

Every third-party inference provider that processes your code on our behalf is subject to a zero data retention agreement: providers do not retain snippets of your code after completing a request and are not permitted to use it to train their own models. Detail does not train models that could reproduce or regurgitate your code or IP. We do use usage data – such as which bug reports customers fix or dismiss – to improve how the service prioritizes and presents findings, as described in our Terms.

​
Internal access follows least privilege

Access to production systems is role-based and restricted to authorized employees with a business need. Production access requires multi-factor authentication over encrypted connections, access rights are reviewed quarterly, and access is revoked promptly when employees depart. All employees undergo background checks and sign confidentiality agreements, as do any third-party contractors who will have any access to customer data. Employees also complete security awareness training during onboarding and annually thereafter. For your own users, Detail supports single sign-on via OIDC and SAML, so you can manage access through your identity provider. See Set up SSO authentication for Detail for setup instructions.

​
Our infrastructure is hardened and monitored

Our network is segmented to prevent unauthorized access to customer data and protected by firewalls and intrusion detection. We run vulnerability scans on an ongoing basis with SLA-enforced remediation. We engage an external firm to perform penetration testing at least annually.

​
Retention and deletion

We retain customer data only as long as necessary to provide the service. Codebase snapshots are deleted within 30 days, and when you leave the service, your data – including source code and anything derived from it – is purged from our environment.

​
Independently verified

These controls are independently audited: Detail maintains a SOC 2 Type II report covering the security trust services criteria. The full report and our latest penetration test results are available through our Trust Center. We also maintain a documented incident response plan with defined procedures for notifying affected customers.