{"scan_data":{"stored":["filename (after sanitisation)","language detected","compliance score","list of findings (rule_id, line number, description, article references)","SHA-256 hash of file contents","scan timestamp + RFC 3161 trusted timestamp","user_id and org_id","system_context (if you provided one)"],"not_stored":["the source code itself — read into memory, analysed, discarded","specific code snippets within findings (only line numbers + description)","any PII detected in code (we don't extract it)"],"retention":"Scan metadata is retained for the active subscription period plus 30 days. Cert hash and timestamp are retained for 7 years to support audit trails."},"infrastructure":{"compute":"Render Frankfurt (EU)","database":"Supabase EU-West-1 (AWS Dublin)","no_data_transfer_outside_eu":true},"advisory":"Filename strings can contain personal data (developer names in paths, etc.). Filenames are sanitised on upload but are still stored. Submit non-sensitive filenames where possible."}