CodeProt

GDPR overview

The site never mentions the GDPR. Across every page collected — terms, privacy policy, support and pricing — there is no occurrence of "GDPR" or "General Data Protection Regulation", no legal basis for processing, no Article 27 EU representative, no standard contractual clauses and no data processing agreement. What stands in its place is thinner. A Data Protection Officer is designated in the privacy policy at support@codeprot.com, the same address as the Privacy Officer and general support. The policy grants rights that overlap the European text (access, correction, deletion, portability, restriction) without ever tying them to it. Section 9 says servers sit in "secure data centers" and that data may be transferred and processed outside your country, naming no country. Governing law is the Federal Arbitration Act, US federal law and California state law.

Who owns the data?

Neither the terms nor the privacy policy claim ownership of your code. Accounts are created by connecting a GitHub or GitLab account: you authorize read-only access on your behalf and warrant you hold the rights to grant it. The publisher states it does not store source code permanently — analysis runs in an isolated environment destroyed afterwards, and only structured results are kept (file names, line numbers, vulnerability locations, recommendations, metrics). It does not sell, trade or transfer source code or personal information; sharing is limited to Stripe, cloud infrastructure providers, Slack, GitHub/GitLab, legal obligations and a business transfer. Issue details, never source code, go to an unnamed third-party AI service.

Reuse rights

Nothing in the terms restricts what the customer does with the output. Scan results, suggestions and reports exist for your own use: opening Jira, Linear or Leiga issues, reporting to stakeholders and tracking resolution. The privacy policy adds explicit rights to access, correct, delete, export ("Export your scan results and repository settings") and restrict processing, plus control over which repositories are authorized, revocation of access at any time, an access history, and management of Slack and Microsoft Teams notifications. The counterpart is responsibility: suggestions are supplied as-is, and the terms make you responsible for testing and validating every code change. Acceptable use forbids breaking the law, hateful content, malware, fraud, privacy violations and scraping the service itself.

Data retention & training

Hosting summary

CodeProt names no hosting country. The privacy policy states only that its servers are located in "secure data centers" and that personal information may be transferred to and processed in countries other than your own, with a general commitment that such transfers comply with applicable data protection laws. No region, no cloud provider and no data residency option is disclosed; section 6.1 refers to cloud infrastructure providers without identifying them, and no European region is offered. What is documented is the handling rather than the location: analysis runs in isolated containers destroyed after each scan, traffic is protected by TLS 1.3, data at rest is encrypted with standard encryption, and access tokens are stored encrypted. On the legal side, the terms place the contract under the law of the State of California. As an indication only, the public website resolves to 34.54.94.124, an anycast address announced by Google LLC (AS396982) and geolocated in the United States — that describes the marketing site, not necessarily where customer data is processed.