Question 1

Is Scanara SOC 2 certified?

Accepted Answer

SOC 2 Type II is planned for Q4 2026. We share our security controls, architecture documentation, and AWS infrastructure details in the vendor evaluation pack. Enterprise customers can request a security review call.

Question 2

Where is data stored?

Accepted Answer

All data is stored in AWS eu-west-1 (Ireland). We never transfer customer data outside the EU. This is confirmed in writing in the vendor evaluation pack.

Question 3

Do you offer a DPA?

Accepted Answer

Yes. A DPA stub is included in the vendor evaluation pack. Enterprise customers receive a customized DPA reviewed by our legal counsel.

Question 4

What data does Scanara process from my codebase?

Accepted Answer

Scanara processes source code files for pattern matching during a scan. We don't keep a copy of your repository afterward — but scan findings do include short source code excerpts (the flagged lines plus their immediate context), stored per-tenant as part of your scan results and subject to your plan's retention period. Findings are never shared with other customers.

Question 5

How long does the vendor evaluation process typically take?

Accepted Answer

Most procurement teams complete their Scanara vendor evaluation in 1–2 days using the pre-filled questionnaire. Enterprise agreements with custom DPA review typically complete in 2 weeks.

Vendor Evaluation Pack

5 documents in one download

30-question security questionnaire

DPA template stub

Sub-processor list

Architecture overview

EU data residency confirmation

Get the pack

Key facts for procurement

Frequently Asked Questions