Your installation. Your data.

The operator of this server

This installation stores accounts, inventories, provider connections and activity in the database selected by its operator. It has no runtime dependency on ChatGPT hosting or login. Ask the operator who provided this dashboard about their hosting region, privacy contact and backup/access practices. The operator can access stored data and configured integrations.

Accounts and collectors

Accounts store an email address, scrypt password hash and verification/session metadata. Passwords are not stored in plaintext. Session cookies are HTTP-only; public HTTPS uses Secure cookies. Device approval produces a scoped collector token; the database stores its hash. Revocation blocks subsequent requests.

Collectors send selected package identities/versions, asset labels, coverage, host observations and timestamps. They do not scan source contents or upload environment variables, keys or IP addresses. Labels and user-entered notes can still contain sensitive information; review them. Serverless inventory is supplied by the application/build, not inferred from runtime reachability.

External integrations you enable

OSV receives supported identities/versions during matching. Public NVD/CISA/GitHub feeds provide published advisories. Connected repositories use a selected-repository credential encrypted under this server's master key; scans read lockfiles, while approved repair workflows can create branches and PRs. Provider credentials are not returned by list/export APIs.

Configured SMTP sends verification/reset messages and security notifications. Pending mail may contain one-time authentication links; delivered content is cleared. Your chosen model receives up to 50 findings plus coverage metadata. API keys for central profiles are encrypted here; local CLI provider keys remain on your machine. Provider terms and processing regions apply. A configured operator-managed model uses the operator's own provider account.

Retention and deletion

The dashboard retains one full report and 50 summaries per asset, plus the latest 200 workspace alerts. Reviews expire within at most 30 days. Model plans and mail are retained for up to 30 days; sent message text is cleared after delivery, and delivered mail metadata is pruned after seven days. Security audit records expire after 90 days.

Delete an asset to remove its stored report, related history/reviews/jobs and repository connection. Delete saved workspace data to remove inventories, connected-provider credentials, models/plans, alerts, policies and upload tokens. The login account and separately collected waitlist signup remain. Exported reports exclude provider credentials; keep exports private. Database backups follow the operator's own retention policy and are not automatically rewritten by account actions.

Waitlist, logs and public demo

The optional landing-page waitlist stores an explicitly supplied email, role, server range, consent version and signup time. It is separate from an account. No marketing campaign is sent automatically; contact this installation's operator to remove a signup. Establish a privacy contact and unsubscribe handling before marketing.

Rate limits retain hashed IP/email-derived keys for bounded periods. Application error logs omit tokens, passwords, report bodies and email contents; infrastructure may keep its own logs. The public demo contains illustrative data. Demo imports/reviews stay in the current tab and disappear on reload. No advertising or model API is embedded in that demo.