Security & Data Protection at Scanara

Customer data is stored in AWS eu-west-1 (Dublin, Ireland): scan results with short code excerpts, assessments, dossiers and audit records. Scanara does not keep a full copy of your repository. During a scan, files are read from GitHub (USA) into short-lived memory in eu-west-1. Frankfurt (eu-central-1) is the designated failover region; a full failover has not been tested yet. Website analytics loads only after you consent to cookies and sends usage data to Google and Microsoft in the USA, based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Stored data is encrypted with AES-256. Data in transit uses TLS 1.2 or higher. The audit store and the logs use dedicated KMS keys that Scanara manages in its own AWS account.

Sign-in uses AWS Cognito with advanced security (adaptive authentication, compromised-credential checks). Multi-factor authentication with an authenticator app is available but optional; Scanara does not enforce it. Enterprise customers can use single sign-on through OIDC; SAML is planned.

Actions in Scanara are written as events to a write-once log (S3 Object Lock in compliance mode), each with a SHA-256 integrity hash. Scanara keeps these records for at least 10 years on every plan. Providers of high-risk AI systems must keep their documentation for 10 years after the system is placed on the market or put into service (Article 18(1) of the EU AI Act).

Scanara documents its GDPR measures: a record of processing activities, a data protection impact assessment for source-code scanning, transfer impact assessments for its US vendors and a data processing agreement under Article 28. Account and organization data is deleted or anonymized within 30 days of closure. Scanara does not train AI models on customer code.

Roles limit what each user can do in an organization: organization admin, compliance officer, AI engineer, auditor and viewer. Data is separated per organization by organization-scoped queries and row-level security. Scanara staff reach AWS through IAM Identity Center, without long-lived credentials.

Scanara holds no security certification today. ISO 27001 is in preparation; SOC 2 and ISO/IEC 42001 are planned, with no published dates. An external penetration test is planned; no date is published. The certifications of AWS cover the AWS infrastructure only.

Procurement

The vendor evaluation pack is for procurement teams

It contains a pre-filled security questionnaire, a DPA template, the sub-processor list, an architecture overview and a data residency statement. The documents are in English.