Privacy & data handling

Contact and pilot inquiries

Contact ProofCI at contact@proofci.com with questions about your information. If you submit an enabled inquiry form, we collect your name, work email, optional GitHub organization, team size, and acknowledgement of this notice. These details enter our customer register so we can discuss fit, follow up, and arrange a pilot. An inquiry does not authorize payment or repository analysis.

Website requests

Cloudflare hosts this website and processes request information to deliver and protect it. The inquiry endpoint uses your network address for short-term rate limiting. The form does not send repository source code, and you should not include passwords or access tokens in an inquiry.

Repository analysis

After an agreed pilot is activated, the GitHub App reads selected repository metadata, pull requests, linked issues, changed source, relevant workflow context, and check results. Relevant requirement and source context is sent to the configured AI provider, currently OpenAI, to propose evidence mappings. ProofCI validates source anchors and applies report rules before publishing a GitHub check.

The product requests provider responses with storage disabled. This setting is not a claim of zero provider retention. Confirm the provider’s applicable processing terms and any data residency requirements with us before enabling private source access.

What the service stores

The service stores customer and agreement records, installation and repository identifiers, analysis status, validated reports, bounded usage records, support requests, and an operator activity trail. Reports can contain requirement text, repository paths, and links to source. Customer portal access tokens are stored as hashes; customer sessions use essential, expiring cookies.

Normal automated analysis removes temporary source snapshots at the end of execution. Durable reports and usage records remain until handled under the agreed retention process. Abrupt process termination, hosting logs, and backups need separate operational handling; temporary-file cleanup is not a promise that every copy disappears instantly.

Before a private repository pilot

Your written pilot agreement must identify the service operator, processing locations and providers, the permitted data and purpose, applicable retention periods, and how deletion and backup expiry are handled. This page describes the product’s data flow; it does not assert a certification, a universal retention period, or a completed legal assessment for your organization.

Access, corrections, and deletion

Ask your ProofCI contact to correct your customer record, pause analysis, revoke portal access, or arrange deletion. You can also send a request from your customer workspace. Removing repository access in GitHub stops new eligible work; an analysis already running may finish. We confirm completion of account and data requests rather than treating submission alone as deletion.