Privacy policy

Last updated: November 2026

AIScan is a security scanner for software built with AI. It is operated by VisionEdge, s. r. o., 29. augusta 1503/1A, 958 01 Partizánske, Slovakia (EU), company ID (IČO) 51962161, tax ID (DIČ) 2120848521 ("we"). We are the controller of the personal data described here. Contact: info@visionedge.sk.

The short version

• Uploaded code and downloaded repositories are deleted right after the scan. We keep only the report.
• Secrets found in your code are never stored in full. Reports show only the first and last characters.
• Reports are deleted after 14 days, or earlier when you delete them.
• We do not sell data, show ads or use your code or reports to train AI models.

What we process and why

Code scans (ZIP upload, GitHub repository, files sent through the ChatGPT or Codex plugin)

We process the files you provide only to scan them. The files are deleted when the scan finishes. The report contains file paths, short excerpts with secrets redacted, findings, the list of dependencies and detected AI components. Purpose: providing the scan you requested. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Website scans

We process the address you enter and what the website returns to a normal browser. Deep checks run only after you prove ownership of the domain. We store the report.

Chatbot attack simulations

We process the endpoint address, request template and headers you enter only while the test runs. Headers are not stored. The report contains short, redacted excerpts of the answers.

Live monitoring

When you turn on monitoring we store the list of package names and versions of your project, the alerts we find for it and, if you add one, your webhook address. We keep this until you stop monitoring.

Domain verification

We store the domain, a verification token and a hashed secret for up to 30 days after verification.

Technical data

We store the IP address that started a scan together with the scan record to prevent abuse (rate limits). It is deleted with the report. Server logs are kept for a short time for security and troubleshooting. Legal basis: legitimate interest in securing the service (Art. 6(1)(f) GDPR).

ChatGPT and Codex plugin

When you use AIScan inside ChatGPT or Codex, we receive only the inputs of the tool you call (for example a package name, file contents or a URL). We do not receive or infer your chat history. Tool inputs are not stored after the answer is sent.

Services we contact

To check packages and vulnerabilities we send package names, versions and vulnerability identifiers (never your code) to public databases: OSV.dev, the PyPI and npm registries, GitHub, the US NVD, CISA and FIRST (EPSS). Repository downloads come from GitHub. Alerts go to the webhook you configure.

Retention

• Uploaded files and repositories: deleted when the scan ends.
• Reports: 14 days, or until you delete them.
• Monitoring data: until you stop monitoring.
• Cached public vulnerability data: up to 24 hours.

Your rights

You have the right to access, correct and delete your data, to restrict or object to processing and to data portability. Write to info@visionedge.sk. You can also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

Security

Traffic is encrypted with HTTPS. Uploads are processed in isolated temporary folders. User supplied addresses are checked so the scanner cannot reach internal networks.

Changes

We will publish changes on this page and update the date above.