Who does what

Security is shared: we secure the service, its infrastructure and our own staff's access; your team manages its people, connections and downloads.

What we do, and what you do

We secure the service, its infrastructure and our staff's access; you manage your people, connections and downloads.

Connections you make to code hosts, sign-in providers, AI providers, chat tools and webhook addresses act only on your instructions. Their credentials are stored sealed and can be removed at any time, which stops the connection at once.
You choose who joins your organisation and with which role, and remove people who leave.
You keep your own sign-in methods, identity provider and connected accounts (code hosts, AI providers, chat tools, webhook endpoints) secure.
You upload only firmware and code you are entitled to have analysed, and protect the exports and reports you download.
You send firmware, credentials and other secrets only through the app, never by email or through this website's forms.

Confidentiality, training, chosen suppliers and every infrastructure change recorded.

Everyone with access to customer data is bound by written confidentiality obligations and receives security and privacy training when they join and every year.
Suppliers that process customer data are listed in Annex B of the Data Processing Agreement, chosen for their security and bound by data protection terms no less protective than ours.
Changes to the service and its infrastructure are reviewed before release, and the infrastructure is defined as code, so that every change is recorded.