We ask you to trust us with source code, so here is exactly what happens to it and what our attestations do and do not claim.
Code you paste into /try or send to our API is processed once, in memory, to run the scan and generate a fix. It is not stored after the response, and it is never used to train models. Connected-repository scanning (Pro and above) reads only the files needed to evaluate a control and holds them for the duration of the scan.
An Attestloop attestation records a verified code change: a finding, the fix, a re-scan that confirms the finding is gone with no regression, and the framework requirements that fix satisfies. Entries are sha256 hash-chained so any alteration is detectable. Anyone can recompute and verify the chain at /verify with no account.
High-judgment controls are co-signed by a named, credentialed reviewer whose credential is bound into the entry hash. That makes the evidence accountable to a real person. It is not a certification: SOC 2 and ISO 27001 certificates are issued by accredited auditors and CPA firms. Attestloop produces the technical evidence those audits and your customers' security reviews rely on.
GitHub access uses least-privilege scopes: contents on fix branches, pull-requests to open PRs, and checks to read CI status. We never request access to your default branch beyond opening a PR against it, and we do not read secrets. Any credential we detect in your code is flagged as a finding, never logged.
The service runs on managed EU infrastructure. Attestation records for a published Trust Page are public by design; everything else is scoped to your workspace. Report a vulnerability or ask a data question at security@attestloop.com.