MagSolutionsAI
Privacy Policy
Last updated: 10 September 2026
The short version: we do not store your source code. Two things are read: the code already in your repositories, once, when you install; and the added lines of each pull request after that. Both are analysed in memory and discarded as soon as the audit finishes. We keep only the metadata needed to run and bill the service.
1. Who we are
MagSolutionsAI ("we", "us") provides a GitHub App that audits your repositories for security issues: once when you install it, and then on every pull request.
Contact: contact@magsolutionsai.com
2. What we process
2.1 Processed in memory, never stored
| Data | Purpose | Retention |
|---|---|---|
Install-time scan. When you connect your installation we read files from up to 5 repositories, at most 40 files each, none larger than 120 KB. Only paths that can hold the failure we look for: .env files, next/nuxt/vite/astro config, and .ts .tsx .js .jsx .mjs .py files under src app lib pages components server api. Documentation, images, binaries and everything else are never requested | Report credentials already committed, and service keys exposed to the browser, before you open your first pull request | File contents are discarded as the scan runs. The summary stays in memory only and is lost when the service restarts; it holds counts, file paths and line numbers — never file content |
| Pull request diff (added lines) | Detect secrets, vulnerabilities and dependency issues | Discarded once the audit completes |
| Audit report (findings with file, line and the affected code fragment; detected secrets are redacted) | Serve the report linked from the PR comment | Ephemeral: held in memory for up to 7 days, and lost when the service restarts. It is not an archive: save a copy if you need one |
2.2 Stored
| Data | Purpose | Retention |
|---|---|---|
| GitHub installation ID | Identify your installation | Until you uninstall |
| Organisation login | Identify the account | Until you uninstall |
| Repository name, pull request number | Usage log and support | Until you uninstall |
| Risk level, number of findings | Usage metering and billing | Until you uninstall |
| Plan, usage counters, dates | Billing | Until you uninstall |
We never write to disk: the diff, your source code, or the value of any secret detected. When we detect a credential we report its location — we do not retain the credential itself. The only place a code fragment survives the audit is inside the ephemeral report above, in memory, so that the person reading the PR comment can see the flagged line.
2.3 Website usage counts
Our website sends a handful of counts to our own server — a page was viewed, the install button was clicked, a checkout was started. Each is a single event name and a timestamp: no cookies, no IP address, no user agent, no identifier of any kind, and nothing goes to any third party. There is no way to tell two visitors apart, and no way to opt out because there is nothing personal to opt out of.
3. Third parties
| Recipient | What we send | Why |
|---|---|---|
| PyPI (pypi.org) | Package names only | Verify a dependency exists and when it was first published |
| npm (registry.npmjs.org) | Package names only | Same |
| GitHub | The audit comment we post on your pull request | Deliver the result |
No source code is ever sent to any third party. We do not download, execute or sandbox the packages we check — we only ask the registry whether a name exists.
We do not use your data to train machine learning models. We do not sell or share your data with advertisers or data brokers.
4. Where data is processed
The service runs on a dedicated server hosted by Hetzner Online GmbH in Finland (European Union). Data is not transferred outside the EU except for the registry lookups and GitHub API calls described in section 3.
5. Security
- Every webhook event is verified with HMAC-SHA256 before processing; unsigned or tampered requests are rejected.
- Credentials are held in environment variables and files kept out of version control.
- Server access is restricted to key-based SSH.
6. Data breaches
If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected organisations without undue delay.
7. Your rights
If you are in the EU/EEA or the UK, you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. To exercise any of these rights, contact contact@magsolutionsai.com.
Deleting your data: uninstalling the GitHub App removes our access to your repositories. To request deletion of the stored metadata, contact us and we will delete it within 30 days.
You also have the right to lodge a complaint with your local supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD).
8. Changes
We will update the date at the top of this page when this policy changes. Material changes will be announced and, where required, notified to installed organisations.