Security at CodeStax
We build a security product — so we hold ourselves to the highest standards. Your code is processed ephemerally, encrypted in transit and at rest, and never used for AI training.
We never store your source code at rest. Code is cloned, scanned, and deleted — all within isolated containers that are destroyed after every scan.
Code Processing
- Source code is cloned into isolated containers and deleted immediately after scanning
- No persistent storage of customer source code at rest
- Scan results and metadata stored securely, isolated per organization
- AI providers (OpenAI, Google, Anthropic) process snippets under strict DPAs — no training on your data
Encryption
- TLS 1.3 encryption for all data in transit
- AES-256 encryption for sensitive data at rest (OAuth tokens, API keys)
- Fernet symmetric encryption for stored credentials
- Database connections encrypted with SSL certificates
Authentication & Access
- Multi-provider OAuth (GitHub, Google, GitLab, Bitbucket, Azure AD)
- Role-based access control: Owner, Admin, Member, Viewer
- Organization-level tenant isolation on every database query
- API key authentication with per-key scoping and rotation
- Optional 2FA enforcement per organization
Infrastructure
- Hosted on SOC 2 compliant cloud infrastructure
- VPC-isolated scanner workers with no public internet access
- Containers rebuilt from scratch on every scan (no persistent state)
- Rate limiting: 500 req/min per IP with sliding window
- Host-level Nginx with Let's Encrypt SSL (auto-renewed)
Monitoring & Audit
- Comprehensive audit logging of all admin and security actions
- Real-time monitoring of scan execution and system health
- Structured logging with correlation IDs across all services
- Automated alerts for security anomalies and system failures
Compliance
- SOC 2 Type II (in progress)
- GDPR compliant — data export, account deletion, 30-day grace period, anonymization
- CCPA compliant — right to know, right to delete, no data sales
- Cookie consent — essential cookies only, no advertising or tracking
- Data retention policies configurable per organization
- Self-hosted / on-prem option for regulated industries
Have security questions?
Reach out to our security team at security@codestax.co or request our SOC 2 report.