Privacy
Privacy Policy
Product: Guardix (https://guardix.io). Contact: guardix@dome.net. Effective date: 3 November 2026. Related: Security & data handling .
"Guardix" and "we" on this page mean the operator of guardix.io. This page does not name a separate legal entity, registered address, or governing jurisdiction. Contact remains guardix@dome.net.
This policy describes personal data Guardix processes when you use the website and the audit product. Product mechanics for code access, retention, and model providers are also stated on /security/. If this policy and that page disagree on code handling, the security page's current text wins for those mechanics until both are updated together.
1. What we collect
Account and identity
When you sign in:
- GitHub: we request
read:useranduser:emailonly. - Google: we request
openid,email, andprofile.
Neither sign-in path can read your repositories by itself.
Repository access (separate step)
Code access uses a GitHub App installation you start after sign-in, on repositories
you choose, with read-only permissions (contents and metadata). We never request write access. The audit worker uses a short-lived installation token for that run.
Audit artifacts
After a completed audit we keep, in a private storage bucket: findings and evidence (including relevant code snippets), architecture artifacts, the report, and a snapshot of the audited source (so evidence links and re-audit diffs keep working). Nothing about an audit is public unless you create a share link. Downloads use short-lived signed URLs.
Payments
When you pay for an audit, payment is handled by a third-party payment processor. We do not store full card numbers. We keep records needed for the purchase: amount, currency, status, and the processor reference.
Website analytics
The marketing site can load Google Analytics (gtag) with measurement ID G-B4RDC4S5ZK. That tag can set cookies and collect device and usage data, for example pages viewed, approximate location from IP, and browser or device type. Analytics does not run until you allow it.
Support chat
The site includes a support chat. Messages you send there, and any contact details you include, reach the Guardix team so we can answer.
Technical logs
Servers and job runners may keep short-lived operational logs: timestamps, request paths, error codes, and job identifiers. We use them to run and debug the service.
2. Why we use this data
| Data | Purpose |
|---|---|
| Account identity | Authenticate you, show your account, contact you about audits you run |
| GitHub App access | Clone the pinned commit you selected and run the audit |
| Audit artifacts | Deliver the report, keep evidence resolvable, support re-audits and share links you create |
| Payment records | Complete the purchase and handle billing questions or refunds |
| Analytics | Understand how the site is used and improve it |
| Support chat | Answer questions and handle deletion or DPA requests |
| Technical logs | Operate, secure, and debug the product |
We do not sell personal data.
3. Model providers (your code)
A standard audit sends code to the commercial APIs of Cursor (Composer), Anthropic (Claude), and OpenAI. That list matches /security/ as of this page's last update; if it changes, both pages change.
Guardix does not train models on your code. We call those providers through their standard commercial APIs to run the analysis.
4. How long we keep data
- Working clone: deleted when the run ends; the job container is destroyed.
- Audit artifacts (including source snapshot): kept until you ask us to delete them, or until we close the account under a separate retention schedule we confirm with you in writing.
- Account identity: while your account exists, then for a short period needed for security and legal records.
- Payment records: as long as tax and accounting rules require.
- Analytics / logs: according to the tool's retention settings and our operational needs; not kept longer than useful for those purposes.
To delete an audit's artifacts (including the source snapshot), email guardix@dome.net or message us in the site chat. After deletion, that report's evidence links stop resolving.
5. Who we share data with
We share data only with processors that help us run Guardix, under contracts where required, for example:
- GitHub and Google (sign-in and, for GitHub, App repository access you grant)
- Model providers listed above (code and related prompts for the audit)
- Cloud hosting and object storage for the app and private audit bucket
- Payment processor for checkout
- Google Analytics for site measurement (subject to consent where we require it)
We may disclose data if required by law or to protect the service or users from abuse or security incidents.
6. International transfers
Guardix and its processors may process data in the EU, the United States, and other countries where those providers operate. Where a transfer needs a safeguard under applicable law, we rely on the provider's published mechanisms (for example standard contractual clauses) or another lawful basis.
7. Your rights
Depending on where you live (including under the GDPR if it applies), you may have rights to access, correct, delete, or restrict processing of your personal data, to object to certain processing, and to data portability. To exercise these, email guardix@dome.net. You may also complain to your local supervisory authority.
Organization-specific needs such as custom retention, a data-processing agreement, or where artifacts are stored are handled case by case. Email us rather than relying on this page alone.
8. Children
Guardix is for professional use. We do not knowingly collect personal data from children.
9. Changes
We will update this page when our practices change. The effective date at the top will change. Material changes that affect how we handle audit code will also be reflected on /security/.
10. Contact
Email: guardix@dome.net
Site chat: bottom-right on guardix.io