How we handle your code.
Cecuro's products read your code to secure it. This page says exactly what that means: what runs where, what we keep, and what we never do.
Ozone — continuous review
You choose which repositories the GitHub App can reach, and can change or revoke that access at any time from GitHub.
An isolated sandbox per review
Each review clones your repository into its own isolated sandbox. Nothing is shared between runs or between customers, and the sandbox is destroyed the moment the run ends.
Your repository is never stored
The clone lives only inside that sandbox — no copy of your repository sits on Ozone's servers. What Ozone keeps is the review itself: the findings and the run transcript, the record of what the agent read and did.
Never used for training
Your code is never used to train AI models, and product analytics never include repository content, prompts, or finding text. Ozone never pushes code — it writes only pull request comments and checks.
Model requests are processed by Microsoft Azure OpenAI. Reviews run in sandboxes provided by e2b; the application runs on Cloudflare. Full details in the Ozone docs and the Ozone privacy policy.
Audit engagements
Deep point-in-time reviews, scoped and supported directly by the founding team.
Scoped access, agreed up front
Audit engagements are scoped directly with the founding team. Which repositories we access, how code is shared, and the confidentiality and disclosure terms are all agreed in writing before any work starts.
The deliverable is what we keep
Analysis runs against the agreed commit in isolated, ephemeral compute in the EU that is destroyed when the job ends — the audit pipeline does not store your repository. What Cecuro retains is the deliverable: the report, the findings, and the analysis records behind them, which can quote the code they discuss, kept in encrypted EU storage for up to 12 months.
Never used for training
Audit engagement code is never used to train AI models. Model requests are processed by Microsoft Azure OpenAI.
Questions, questionnaires, DPAs.
Security questionnaires, data processing agreements, and custom confidentiality terms are handled directly by the founding team.
[email protected]