Skip to main content

Trust

Trust center

Last updated 6 November 2026

You give Defexity your website, sometimes your repositories, and your project plans. This page says plainly what we do with them, what we can and cannot see, and how to check it yourself. The full legal detail is in the privacy policy; how the scanner behaves on other people’s sites is on the security page.

Your data stays in your workspace

  • Every project, scan, finding, monitor, task, board, assistant and conversation belongs to one workspace, and the database itself enforces it with row-level security. A bug in one page cannot show another workspace’s rows, because the database refuses the query.
  • Every link you make (a task to a finding, a board to a project) is checked as belonging to your workspace before it is saved.
  • Teammates see only the workspaces they were invited to. Your in-app AI chats are visible only to you, not to teammates.

Encrypted at rest, field by field

On top of the disk encryption our hosts provide, these are encrypted with AES-256-GCM before they reach the database:

  • Your email address and name, and the device details in your security log.
  • Your task titles, notes and checklists, and your board names and plans.
  • AI chat messages, and website-assistant conversations with your visitors.
  • Test-account passwords and API tokens you give a monitoring check or chatbot test. They are write-only: after you save them, nobody, including you, can read them back.

Secret values found during a scan are masked before anything is stored. IP addresses are kept only as keyed one-way hashes.

Exactly what the GitHub App can do

Connecting GitHub is optional. You choose which repositories the app can see, and you can remove it at any time in your GitHub settings.

  • Contents: read-only. To read dependency lockfiles and GitHub Actions workflow files for the dependency and workflow checks, and the list of changed files when a deployment fails.
  • Metadata: read-only. Repository names and default branch. GitHub grants this to every app.
  • Deployments: read-only. To know when a new version went live, so the deployment guard can test it.
  • Pull requests: read and write. Only to post one comment with test results on Pro and Agency, edited in place on reruns. It cannot merge, approve or change code.

We never clone your repository or keep its source. GitHub access tokens are held in memory only; they are never written to the database or logs. Uploaded code archives are read in memory, never run and never kept.

AI only gets what an answer needs

When you ask an assistant, build an AI board or get a failure diagnosis, the AI model receives only that request’s context: your question or description, the relevant findings, and for connected repositories short excerpts of what changed, with secrets masked first. Defexity does not use your data to train any model. Site-wide daily limits stop runaway AI use.

Who processes data for us

  • Railway: hosts the website and dashboard.
  • Amazon Web Services (Mumbai): background worker and nightly database backups.
  • Supabase: sign-in and the database.
  • Cloudflare: domain, DNS and the network in front of the site.
  • Groq: runs the AI model.
  • Brevo: sends account and alert emails.
  • GitHub: only for repositories you connect.
  • Paddle: payments, as merchant of record. We never see your card.

Backups, deletion and leaving

  • The database is backed up every night and backups are kept for 14 days. Restores are tested: the latest test restored every table with matching row counts and readable encrypted fields (5 November 2026).
  • Download my data and Delete account are in Settings, no email needed. Deletion is immediate; copies in backups expire within 30 days.
  • Scan reports, monitoring runs and conversations are deleted automatically after your plan’s history period.

Protecting your account

  • Two-factor sign-in, required for owners and admins before they change billing, the team, API keys or delete the account.
  • A security log of sign-ins, password, two-factor and API key changes, and a list of your active sessions.
  • Rate limits and a bot check on sign-up and sign-in, and alerts when one address tries many accounts.

Check our work

A security tool should pass its own tests. Point our free checks at defexity.com: the security headers checker, the HTTPS checker, the exposed files checker and the API key leak checker. Independent tools such as Mozilla Observatory and SSL Labs will show the same. Every scanner rule is documented in the rule reference, and the changelog lists what changed and when.

If something goes wrong

If a security incident affects your data, we will email the owners of affected workspaces without undue delay, and within 72 hours of confirming it, saying what happened, what was affected and what to do. Found a vulnerability? Please report it privately: email [email protected], or see security.txt.

What we do not claim

Defexity is run by one person (see about). We do not hold SOC 2 or ISO 27001 certification and do not say we do. Scan results are potential risks, not a guarantee of security, and not legal advice.