Privacy notice
This notice describes data handling visible in the current CodeSage implementation. It is not a claim about an operator’s unverified hosting or retention practices.
Why information is processed
CodeSage uses identity information to authenticate users, memberships to control workspace access, repository data to analyze technical debt, and operational records to run and troubleshoot the service.
Data and processing services
Account, session, workspace, invitation, repository, analysis, and evidence records are processed. Authentication goes through Asgardeo and its configured identity provider. GitHub supplies repository data. Invitations use the configured email integration. Comment text and code metrics are sent to the configured ML service. Hosting, database, queue, and logging operators may process the corresponding service data.
Cookies and browser preferences
The browser uses a session cookie for authenticated access. The backend stores a hash of its token. Browser storage also holds interface preferences and temporary workflow state, such as a pending invitation. Signing out revokes the CodeSage session; it does not delete stored scan history.
Source code and access
Repositories are cloned for analysis. Temporary clone cleanup is attempted after scans, but finding descriptions and comment evidence remain in stored results. Workspace permissions restrict application access; operational administrators may have infrastructure access.
Retention and deletion
The application retains analysis history until removed through supported project or workspace operations. The code alone does not establish a universal backup or log retention schedule. Workspace deletion does not mean all copies in provider backups are immediately erased. Contact the deployment operator for applicable retention and deletion arrangements.
Questions and deployment details
Ask the organization or project team operating this deployment about privacy questions and requests. The operator’s legal identity, privacy contact, hosting regions, backup retention, and any use of data beyond this scan workflow must be confirmed by that operator; those details are not established by this notice.