Security & privacy
You trust us with the bill of materials of your software. This page explains where that data lives, who can access it and which providers are involved.
Who runs Secupipe
Secupipe is operated by Konstantin Kauz Cloud Solutions Ltd in Larnaca, Cyprus, a company in the EU. It is your contact for contracts, data protection and security questions. More about us on the About page, full details in the legal notice.
Where your data lives
- Data center in Germany: the app, the API and the database run on servers of Hetzner Online GmbH in Germany.
- Database not reachable from the internet: the database only accepts local connections on the server.
- Protected access: all traffic is encrypted (TLS) and passes through Cloudflare. For the API, the firewall only lets the intended endpoints through and limits the number of requests per address.
- Server access only when needed: maintenance access to the server is closed and only opened for the duration of a deployment.
What we see of your software
- No source code: your pipeline sends us an SBOM, the list of components with name, version and package identifier, plus commit, branch and a link to the pipeline run.
- Fix PRs stay with you: updates for vulnerable components are built and tested by a container in your own pipeline. Your code never leaves your environment.
- AI code scan and AI fixes run on your side: With the AI module, an AI agent works on your CI runner, using your own key with the AI provider. Your source code goes to that provider, not to Secupipe. Secupipe only receives the result: file, line, description and recommendation of the finding, plus the status and link of the pull request.
- Vulnerability matching without personal data: OSV and FIRST (EPSS) only receive package identifiers and CVE IDs, no names, companies or content.
- No AI training: your content is not used to train AI models.
Access and traceability
- Strict separation: each company has its own workspace. The separation is enforced by the API on every request, not just in the interface.
- No passwords stored by us: sign-in is handled by WorkOS, including Google, Microsoft or LinkedIn. We do not store passwords.
- Roles: admin, member and read-only auditor, for example for external auditors.
- Immutable audit log: every assessment, report and change is logged with time and author and can be exported.
- Payment data: card data is processed by Stripe only. We never see full card numbers.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and database | Germany |
| Cloudflare, Inc. | Delivery, TLS, firewall, attack protection | USA |
| WorkOS, Inc. | Sign-in, sign-up, single sign-on | USA |
| Microsoft Ireland Operations Ltd. | Email (Microsoft 365) | Ireland |
| Stripe Payments Europe, Ltd. | Payment processing | Ireland |
| eCloud Systems FZE | Invoicing for paid plans | United Arab Emirates |
| Google Ireland Limited | Website only, with consent: Google Analytics; demo video (YouTube) | Ireland |
| Meta Platforms Ireland Ltd. | Website only, with consent: ad measurement | Ireland |
For transfers to third countries we rely on adequacy decisions of the European Commission or EU standard contractual clauses. See the privacy policy for details.
Data processing agreement (DPA)
We act as processor for your content in Secupipe. You can request the DPA under Art. 28 GDPR, including technical and organisational measures, at [email protected].
Found a vulnerability in Secupipe?
Please report it confidentially to [email protected], ideally with steps to reproduce. We respond promptly and keep you posted on the fix. Our contact details are also in security.txt.
In preparation
A self-hosted edition as a Docker container for your own data center or cloud is in preparation. If you would like to test it early, write to us.