// TRUST CENTER
Your code is some of your most sensitive data.
Veyra is designed around minimizing access, isolating analysis, and giving you control over every connected asset. This page describes how that works, in enough detail that your engineers can evaluate it rather than take our word for it.
Read-only, scoped, and revocable.
Veyra connects through a GitHub App you install on the specific repositories you choose. It requests the minimum permissions the analysis requires.
| Permission | Level | Why it is needed |
|---|---|---|
| Repository contents | Read | Retrieve the code to be analyzed, including history for secret detection. |
| Metadata | Read | Resolve repository names, default branches, and languages. |
| Pull requests | Read | Only where pull-request analysis is enabled on your plan. |
| Security events | Read | Only where you choose to correlate existing GitHub security alerts. |
| Any write permission | Not requested | Veyra cannot modify, merge, or delete your source code. |
Veyra cannot modify, merge, or delete your source code
No write permission is requested on any plan. If a future capability ever required one, it would be a separate installation prompt requiring your explicit, informed consent — never a silent scope expansion on an existing installation.
Credential handling
- SHORT-LIVED TOKENS
- Repository access uses short-lived installation tokens issued per assessment rather than long-lived personal access tokens.
- SECRETS MANAGER
- All credentials are held in a managed secrets store, never in source, configuration files, or environment templates committed to a repository.
- NO PRODUCTION SECRETS IN SOURCE
- Veyra applies the same rule to itself that it enforces for customers. Its own repositories are scanned for secrets on every push.
- SCOPED PER TENANT
- Credentials are scoped to a single customer organization. There is no shared credential with access across tenants.
Encryption in transit and at rest.
- IN TRANSIT
- TLS 1.2 or higher for all external connections, including the dashboard, the API, source-control integrations, and webhook delivery. HTTP Strict Transport Security is enforced on all web properties.
- AT REST
- Findings, metadata, and any retained evidence are encrypted at rest using AES-256 through managed provider encryption.
- BACKUPS
- Backups are encrypted with the same standard, access-controlled separately from production, and restore procedures are tested.
- SECRETS
- Application secrets and integration credentials are held in a dedicated managed secrets store with access logged.
Every assessment runs in a disposable environment.
The analysis environment exists for one assessment, for one customer, and is destroyed when the run completes.
- NO SHARED ANALYSIS STATE
- Analysis environments are not reused between customers. Each assessment gets a clean environment.
- TENANT ISOLATION
- Customer data is logically isolated at the data layer, with tenant scoping enforced on every query — the same control Veyra checks for in your code.
- ENVIRONMENT SEPARATION
- Development, staging, and production are fully separate environments with separate credentials. Customer data is never copied into development or staging.
- MINIMIZED AI EXPOSURE
- Source code is not sent wholesale to third-party AI providers. Where AI assisted reasoning is applied, it operates on the minimum context required for the specific analysis.
What is kept, and for how long.
Veyra keeps the minimum needed to describe findings and show your risk trend over time.
| Data | Retention | Notes |
|---|---|---|
| Repository working copy | Duration of the assessment only | Destroyed when the analysis run completes. |
| Findings and metadata | 90 days / 1 year / 2 years | By plan: Essential, Growth, Advanced. |
| Code excerpts used as evidence | Same as the parent finding | Limited to the lines needed to explain and reproduce the issue. |
| Audit logs | 1 year minimum | Security-relevant actions, retained independently of plan. |
| Account and billing records | As required by law | Payment details are held by Stripe; Veyra does not store card numbers. |
| Backups | 35 days rolling | Deleted data ages out of backups within this window. |
Deletion means deletion
On request, Veyra deletes your findings, evidence, and repository metadata from production systems within 30 days, and from backups within the backup retention window. Audit records of security-relevant actions and records required for legal or accounting obligations are retained. You receive written confirmation when deletion completes.
You can withdraw access at any moment.
Control that requires a support ticket is not control.
IN THE DASHBOARD
- Disconnect any repository immediately
- Remove an application, domain, or API from scope
- Pause all assessment activity
- Adjust rate limits, excluded endpoints, and maintenance windows
- Export your findings and reports
- Request deletion of your organization’s data
IN GITHUB
You can revoke the Veyra GitHub App from your organization settings at any time, without notifying us. Access ends immediately and any assessment in progress fails closed.
Because Veyra never holds write access and never holds a long-lived token, revocation is complete rather than partial.
Who at Veyra can see what.
- MULTI-FACTOR AUTHENTICATION
- Required for every Veyra team member on every system that touches customer data or infrastructure.
- LEAST PRIVILEGE
- Access is granted by role, scoped to what the role requires, and reviewed on a defined schedule and on every role change.
- NO BLANKET SOURCE ACCESS FOR SUPPORT
- Ordinary support personnel cannot browse customer source code. Support tooling exposes finding metadata, not repository contents.
- JUST-IN-TIME ELEVATION
- Where a specific investigation requires deeper access, it is time-bound, justified, approved, and logged.
- ADMINISTRATIVE ACTIONS LOGGED
- Every administrative action against a customer organization is recorded with actor, timestamp, and reason.
- OFFBOARDING
- Access is revoked as part of departure, and credentials the individual could have observed are rotated.
Security-relevant actions are recorded.
Both yours and ours. Audit records are available to your organization administrators.
LOGGED EVENTS
- Authentication and session events
- Repository connection and disconnection
- Authorization agreement creation and change
- Assessment start, completion, and failure
- Finding status changes and severity adjustments
- Report generation and export
- User invitation, role change, and removal
- Veyra administrative access to your organization
- Data deletion requests and completion
Every record includes the actor, the affected resource, a timestamp, and where relevant the reason. Logs are retained for at least one year on every plan, independently of your finding-retention period, and are write-once from the perspective of the application.
Advanced plans include export of audit records for ingestion into your own logging or SIEM systems.
Third parties in the path of customer data.
This list is maintained as the platform develops. Customers are notified in advance of any material change.
| Subprocessor | Purpose | Data involved |
|---|---|---|
| Cloud infrastructure provider | Application hosting, databases, ephemeral analysis environments | Findings, metadata, transient repository working copies |
| Vercel | Marketing site and form handling | Contact form submissions |
| Stripe | Payment processing | Billing details. Veyra does not store card numbers. |
| Email delivery provider | Transactional email and alerts | Email address, finding identifier and severity — never exploitable detail |
| GitHub | Source control integration | Repository contents, accessed read-only under your installation |
To be notified of subprocessor changes, email security@veyra.example and ask to be added to the notification list.
Where Veyra actually stands.
Veyra holds no security certifications at this time
Veyra is not SOC 2 certified, ISO 27001 certified, HIPAA compliant, PCI DSS certified, or FedRAMP authorized, and has not completed an independent third-party penetration test. Any vendor page claiming otherwise on our behalf is wrong. When these are genuinely achieved, they will be published here with the assessing body, the scope, and the date — and not one day earlier.
What Veyra can offer today is the technical detail on this page, a completed security questionnaire on request, and a direct conversation with the people who built the system. If your procurement process requires a certification Veyra does not hold, we will tell you that immediately rather than waste your evaluation cycle.
Found a problem in Veyra itself?
A company that asks for access to your source code should be prepared to receive security reports about its own systems, and should make that easy.
SECURITY CONTACT
Acknowledged within one business day. Safe harbour applies to good-faith research within the published scope. A machine-readable contact is published at /.well-known/security.txt.