Skip to main content
Enclave reads your code and cloud to find real security issues, so we hold ourselves to the same bar. For reports and policies, see the Trust Center.

​
Security

Data is encrypted in transit with TLS 1.2 or later, and at rest with AES-256, using industry-standard key management.
Enclave is SOC 2 compliant. See the Trust Center for our report and policies.
Enclave runs code analysis in isolated sandboxes. A Research sandbox starts without network access. To keep repository checkouts inside your own AWS account, use BYOC.

​
Privacy and data

Enclave keeps your data only as long as it needs to provide the service, following industry best practices. You can delete Research sessions at any time. See our privacy policy.
The GitHub app requests read access to code, pull requests, and webhook events. Enclave never pushes commits and never reads repository secrets. See GitHub.
Cloud access is read-only. On AWS, Enclave assumes the EnclaveScanner role, which only Enclave can assume, with an external ID for your organization. See AWS.
Replies in a channel are visible to everyone in it. Ask sensitive questions in a private channel or a direct message. See Slack.