01The short version
Your source code is sent to AI providers to be analysed. That is how the service works, and it is the single most important thing to understand before you submit anything confidential.
Your source code is not kept. It is deleted as soon as the analysis finishes, with an automatic 24-hour backstop.
We do not use your code to train models, and we do not sell or share your data for advertising. There are no analytics or advertising cookies on this site.
02What we collect
Account and identity
- Your email address and display name, if you register with one.
- A password hash, if you set a password. We never store the password.
- If you sign in with Google or GitHub: the provider's identifier for you and the email address it gives us. We do not receive your password.
- If you sign in with a wallet: the wallet address, and the fact that it was proven by signature.
- Account creation and last sign-in timestamps.
Sessions
When you sign in we store only a hash of your session token, never the cookie value itself, together with its creation, expiry and sign-out times.
GitHub connection, if you set one up
Your GitHub username and numeric ID, the scope you granted, and the access token — which is encrypted at rest. This is optional and exists only so the service can fetch repositories you point it at.
Payments
Your paying wallet address, the on-chain transaction reference, amounts, and the ledger of credits and debits against your account balance.
What you submit
The contract source code you upload or point us at, and the findings report produced from it. See section 3.
Technical logs
Ordinary server logs — request paths, timestamps, status codes, IP address and user agent — used to operate and debug the service, and kept for 30 days. Output from the analysis tools themselves is kept separately for 7 days.
Please do not submit personal data, credentials, private keys or secrets inside your source code. The service is built to analyse contract logic and treats everything you submit as code, not as personal data needing special handling.
03What happens to your code
When you submit a contract for analysis:
- It is stored briefly in a private object store operated by our hosting provider, readable only by this service.
- It is analysed by the deterministic tool suite, each tool running in an isolated sandbox with no network access, a read-only filesystem and dropped privileges. A tool container cannot send your code anywhere. For a DAML package the deterministic step is a compile check, and where an authorization finding is checked against a ledger, a disposable Canton ledger is started inside that same no-egress sandbox and destroyed with the run — your package is never submitted to any ledger outside it, and never to a real or shared one.
- It is sent to AI providers — Anthropic, and AWS Bedrock — so the hunter, jury and judge agents can interpret what the tools found. This transmission is unavoidable: it is the audit you are paying for. It is more central still for a DAML review: no static analyzer exists for the language, so the agents are not interpreting tool output but reading your source directly.
- The uploaded copy is deleted as soon as the run finishes. An automatic lifecycle rule deletes anything left behind within 24 hours, so an interrupted run cannot leave your code sitting there.
We do not use your code to train models, and we do not permit anyone else to do so on our behalf. We access these providers through their commercial APIs, and each provider's own terms govern what it does with the content it receives.
The findings report is kept slightly longer than the code, so that you can re-download it without paying again — see section 8. If you start a remediation engagement, the findings and their status are kept for the life of that engagement.
04Why we process it
| What | Why | Basis |
|---|---|---|
| Account and session data | To let you sign in and reach your balance and your work | Performance of our contract with you |
| Submitted code and reports | To produce the analysis you asked for | Performance of our contract with you |
| Payment and ledger records | To take payment, prevent double-spending, and keep financial records | Contract, and legal obligation |
| GitHub token | To fetch the repositories you point us at | Your consent, withdrawable at any time |
| Server logs | To operate, secure and debug the service | Our legitimate interest in a service that works |
06On-chain payments
Blockchain transactions are public and permanent. When you pay in USDC, your wallet address, the amount and the timestamp are recorded on a public ledger that anyone can read and that nobody — including us — can edit or erase.
This is inherent to how public blockchains work. A request to delete your account cannot and does not remove anything from the chain. It removes what we hold.
08How long we keep things
| Data | Kept for |
|---|---|
| Submitted source code | Deleted at the end of the run; 24-hour automatic backstop |
| Findings report | About one hour after a successful round, so you can re-download it |
| Remediation engagement — findings and their status | Until you delete your account, so your audit history stays complete |
| Remediation engagement — the stored report itself | 30 days from its last round, then cleared. The record of what was found and fixed remains; the full report content does not |
| Account and identity records | Until you delete your account |
| Session records | 30 days, then expired |
| Payment and balance ledger | Six years — kept as a financial record after account deletion |
| Server logs | 30 days |
| Analysis tool output | 7 days |
09Security
- All traffic to the service is encrypted in transit.
- Credentials and signing keys are held in a managed secret store, not in configuration files or the application image.
- Your GitHub access token is encrypted at rest with a key held in that secret store.
- Session tokens are stored only as hashes, so a database disclosure does not hand anyone a usable session.
- Analysis tools run with no network access, a read-only filesystem and dropped privileges.
No system is perfectly secure. If you believe you have found a vulnerability in the service, please report it to grisoco-support@googlegroups.com rather than disclosing it publicly, and we will work with you on it.
10Your rights
Depending on where you live, you have some or all of the following rights over the data we hold about you:
- Access — a copy of what we hold.
- Correction — to fix anything inaccurate.
- Deletion — to have your account and its data removed, subject to records we must keep by law and to what is already on-chain.
- Portability — to receive your data in a machine-readable form.
- Objection and restriction — to object to processing based on legitimate interests.
- Withdrawing consent — for example by disconnecting GitHub, at any time, without affecting processing already carried out.
- Nomination — to nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them yourself.
- Complaint — to the Data Protection Board of India, or to your local data protection authority if you are outside India.
To exercise any of these, contact us at grisoco-support@googlegroups.com. We aim to respond within 30 days. We may need to verify who you are first — for an account secured by a wallet, that means a signature from it.
Grievances
If you are unhappy with how we have handled your data or your request, write to grisoco-support@googlegroups.com with "Grievance" in the subject line. Your complaint goes to the person responsible for answering questions about how this service processes personal data. If you are still unsatisfied, you may escalate to the Data Protection Board of India.
11International transfers
The service runs in India and your data is stored there, and this service is governed by Indian law. Our AI providers and sign-in providers are in the United States, so submitted code and account identifiers are transferred there in the course of delivering the service. Those transfers are made under the safeguards in the relevant provider agreements.
12Children
The service is not directed at anyone under 18 and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
13Changes
We may update this policy. The "last updated" date above always reflects the current version, and for material changes — particularly any change to who processes your code — we will give notice before they take effect.
14Contact
grisoco-support@googlegroups.com
See also our Terms of Service.