The short version

ThreatShield is local-first. Scanning happens on your machine. We do not receive, store, or process your source code, your dependency tree, or your file names, except in the one narrow case described under “AI review” below — which only happens when you explicitly ask for it.

What stays on your machine

• All package scanning, typosquat checks, and lockfile verification.
• The vulnerability database, mirrored directly from osv.dev to your machine — the sync does not pass through our servers.
• Scan findings and SARIF reports, written to local disk.
• Honey-token values and the local audit log.

What we collect

• Account: your email address, and the display name and avatar your sign-in provider supplies.
• Billing: subscription status and plan. Card details go directly to Stripe; we never see or store them.
• Usage counts: how many AI reviews you have run, to enforce plan limits.
• Trap events: if the honey-token engine catches an exfiltration attempt, the destination it was sent to, the package involved, and a timestamp.

AI review

When you explicitly request an AI review, the text of the file you chose is sent to our server, which forwards it to an AI provider (Anthropic or DeepSeek). By default that is the whole file, up to your plan's size limit; you can send only about twenty lines around one line instead. Before it leaves, recognised secret patterns (API keys, tokens, passwords, private keys, connection strings) are replaced with [REDACTED]. This scrubbing is best-effort, so do not review a file you would not be comfortable sharing.

Files that are secret stores, such as .env, private keys and cloud credential files, are refused on your machine and never sent. Your own source code is never sent without that explicit request.

Verdicts are cached by a hash of the text for up to 30 days so an identical request costs nothing. The text itself is not retained beyond the request.

Sub-processors

• Cloudflare — hosting, database, and edge compute
• Stripe — payment processing
• Anthropic and DeepSeek — AI review, only for files you submit
• Resend — sign-in emails

Retention and deletion

Account and billing records are kept while your account is open, and afterwards only as long as tax and accounting rules require. Ask us to delete your account and we will remove your account record, sessions, machine licences, and trap events.

Contact

Add your contact address and legal entity here before publishing.