MagSolutionsAI
Privacy Policy
Last updated: 28 September 2026
The short version: we do not store your source code. Two things are read: the code already in your repositories, once, when you install; and the added lines of each pull request after that. Both are analysed in memory and discarded as soon as the audit finishes. We keep only the metadata needed to run and bill the service.
1. Who we are
MagSolutionsAI ("we", "us") provides a GitHub App that audits your repositories for security issues: once when you install it, and then on every pull request.
Contact: contact@magsolutionsai.com. The controller's identifying details are in the Legal notice.
2. What we process
2.1 Processed in memory, never stored
| Data | Purpose | Retention |
|---|---|---|
Install-time scan. When you connect your installation we read files from up to 5 repositories, at most 40 files each, none larger than 120 KB. Only paths that can hold the failure we look for: .env files, next/nuxt/vite/astro config, and .ts .tsx .js .jsx .mjs .py files under src app lib pages components server api. Documentation, images, binaries and everything else are never requested | Report credentials already committed, and service keys exposed to the browser, before you open your first pull request | File contents are discarded as the scan runs. The summary stays in memory only and is lost when the service restarts; it holds counts, file paths and line numbers — never file content |
Your .magaudit.yml, if the repository has one (paths to exclude, rules to disable, a minimum severity) | Apply the settings your team chose, so we report only what you asked for | Read from your repository on each audit and held in memory for up to 5 minutes. Never written to disk |
| Pull request diff (added lines) | Detect secrets, vulnerabilities and dependency issues | Discarded once the audit completes |
| Dependency names and pinned versions from the files the pull request touches | Ask GitHub's Advisory Database whether that version has a published vulnerability | Sent to api.github.com only. The answer is cached for one hour; the query is not stored. Only the package name and version leave our server — never a line of your code |
| Audit report (findings with file, line and the affected code fragment; detected secrets are redacted) | Serve the report linked from the PR comment | Ephemeral: held in memory for up to 7 days, and lost when the service restarts. It is not an archive: save a copy if you need one |
2.2 Stored
| Data | Purpose | Retention |
|---|---|---|
| GitHub installation ID | Identify your installation | Until you uninstall |
| Organisation login | Identify the account | Until you uninstall |
| Repository name, pull request number | Usage log and support | Until you uninstall |
| Risk level, number of findings | Usage metering and billing | Until you uninstall |
| Plan, usage counters, dates | Billing | Until you uninstall |
| Stripe customer ID and payment events (event type, plan, date), if you subscribe to a paid plan | Link your payment to your installation | Until you ask us to delete it. Invoices themselves are kept by Stripe |
| When you uninstall: a SHA-256 hash of your organisation login and the date your 14-day trial started | Keep the trial from restarting when the App is uninstalled and installed again | Until you ask us to delete it. The login itself is deleted, but anyone who already knows a login can hash it and compare, so treat the hash as identifying your organisation |
| Findings you muted and, where a mute came from a pull request comment, the GitHub username of the person who wrote it — plus the repository, the rule id or an 8-character hash of the finding, and the date | Honour your decision on the next audit, and leave your team an auditable record of who silenced what. The hash is derived from the rule, the file path and the flagged line; it cannot be reversed back into your code, and we store neither the path nor the code | Until you delete the mute (@magaudit restore <id>) or uninstall |
We never write to disk: the diff, your source code, or the value of any secret detected. When we detect a credential we report its location — we do not retain the credential itself. The only place a code fragment survives the audit is inside the ephemeral report above, in memory, so that the person reading the PR comment can see the flagged line.
2.3 Website usage counts
Our website sends a handful of counts to our own server — a page was viewed, the install button was clicked, a checkout was started. Each is a single event name and a timestamp: no cookies, no IP address, no user agent, no identifier of any kind, and nothing goes to any third party. There is no way to tell two visitors apart, and no way to opt out because there is nothing personal to opt out of.
3. Third parties
Every organisation that receives data from us or on our behalf, and exactly what it receives. The first group processes data for us (processors under Article 28 GDPR); the second receives only what is needed to answer a lookup.
| Recipient | What it receives | Why |
|---|---|---|
| Hetzner Online GmbH (Germany; server in Finland) | Everything in section 2, as the host of our server | Run the service |
| Stripe | Your GitHub installation ID, added to the payment link. You type your email and card on Stripe’s own page; they never reach our server. Stripe sends back a customer ID and the subscription status | Take payment for paid plans |
| Namecheap (email forwarding) and Google (Gmail) | Emails you send us: Namecheap forwards mail for magsolutionsai.com, and our mailbox is hosted by Gmail | Read and answer your messages |
| GitHub Pages | This website is served by GitHub Pages, which receives your IP address when you load a page, as any web host does. We receive none of it | Serve this website |
| Recipient | What we send | Why |
|---|---|---|
| PyPI (pypi.org) | Package names only | Verify a dependency exists and when it was first published |
| npm (registry.npmjs.org) | Package names only | Same |
| npm download counts (api.npmjs.org) | Package names only | Weekly downloads of a new dependency: how many people actually use it |
| pypistats.org, an independent service that publishes PyPI download counts | Package names only, and only for Python packages published less than 90 days ago | Same: PyPI itself does not publish download counts |
| GitHub (api.github.com) | The audit comment and check result we post on your pull request; the name and pinned version of dependencies it touches | Deliver the result; ask GitHub’s Advisory Database about published vulnerabilities |
No source code is ever sent to any third party. We do not download, execute or sandbox the packages we check — we only ask the registry whether a name exists.
We do not use your data to train machine learning models. We do not sell or share your data with advertisers or data brokers.
4. Where data is processed
The service runs on a virtual server we rent from Hetzner Online GmbH in Finland (European Union). It is not exclusive to this service: other internal projects of ours run on the same machine. GitHub, Stripe and Google are companies based in the United States, and PyPI and npm are run by US organisations; pypistats.org is an independent service whose hosting we have not verified, so treat it as outside the EU too; what each of them receives is listed in section 3, and nothing else leaves the EU.
5. Security
- Every webhook event is verified with HMAC-SHA256 before processing; unsigned or tampered requests are rejected.
- Credentials are held in environment variables and files kept out of version control.
- Server access is restricted to key-based SSH.
6. Data breaches
If a personal data breach occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected organisations without undue delay.
7. Your rights
If you are in the EU/EEA or the UK, you have the right to access, rectify, erase, restrict and port your personal data, and to object to its processing. To exercise any of these rights, contact contact@magsolutionsai.com.
Deleting your data: uninstalling the GitHub App removes our access to your repositories. To request deletion of the stored metadata, contact us and we will delete it within 30 days.
You also have the right to lodge a complaint with your local supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD).
8. Changes
We will update the date at the top of this page when this policy changes. Material changes will be announced and, where required, notified to installed organisations.