This policy applies to the Audit Bench Ai website at auditbenchai.com, the web app, the command-line tool, the VS Code extension and the GitHub and GitLab integrations (together, the “Service”). “We”, “us” and “our” mean Audit Bench Ai. Questions about this policy can be sent to noumanqureshi15@gmail.com.
1. Information we collect
Information you give us
- Account details: your name, email address and password (stored only as a one-way hash), or your profile details if you sign in with GitHub, GitLab or Google.
- Team details: organization names, member roles and the email addresses you invite.
- Code you submit: files you paste or upload, repositories and pull requests you ask us to scan, and archives you upload for a scan.
- Git provider tokens: personal access tokens you connect for GitHub or GitLab.
- Billing and correspondence: plan requests, payment records and anything you send us by email.
Information collected automatically
- Usage data: the audits and scans you run, which features you use, AI usage and token counts, and sign-in times.
- Device and log data: IP address, browser type, pages visited and timestamps, collected by our servers and by the analytics and advertising services described below.
- Performance data: page-load timing measurements (Web Vitals) used to keep the site fast.
- Free public scans: if you scan a public repository without an account, we keep a one-way hash of your IP address to enforce rate limits. We do not store the IP address itself.
2. How we use information
- To provide the Service: run audits and scans, show reports, post pull request reviews and commit fixes you approve.
- To operate accounts, teams, plans and usage limits.
- To keep the Service secure, prevent abuse and enforce our Terms of Service.
- To understand how the site is used and improve it.
- To show advertising on our public website (see section 4).
- To reply to you and send messages about your account, such as invitations and plan changes.
We do not sell your personal information. We do not use your code to train AI models.
3. Your source code
- Analysis: code is analysed with local static checks. Only code those checks flag as risky is sent to an AI model provider for review. Code is read, never executed.
- What we keep: findings, verdicts, file paths and short code excerpts needed to display and explain findings. Results are cached by a hash of the code so unchanged code is not re-sent to an AI provider.
- Tokens: GitHub and GitLab tokens are encrypted at rest (AES-256-GCM) and used only to read repositories, post reviews and commit fixes you request. You can disconnect them at any time.
- Shared reports: a report becomes public only when you, or a teammate with access, create a share link, and stops being public when sharing is turned off. Shared reports never show where secrets are or who wrote the code.
More detail is on our Security & Trust page.
4. Cookies, analytics and advertising
We use a small amount of browser storage to keep you signed in. We also use the following third-party services, which set their own cookies or similar identifiers:
- Google Analytics to measure visits and how pages are used. See how Google uses information from sites that use its services.
- Google AdSense to show advertising on our public website.
About advertising specifically:
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.
- You may opt out of personalized advertising by visiting Google Ads Settings. You can also opt out of some third-party vendors’ use of cookies for personalized advertising at www.aboutads.info.
- Where the law requires your consent for these cookies, for example in the European Economic Area, the United Kingdom and Switzerland, Google’s consent message asks for it before personalized ads are shown.
You can also block or delete cookies in your browser settings; parts of the site may then not work as intended.
5. Who we share information with
- AI model providers (for example Anthropic, OpenAI or Google), which receive only the code excerpts sent for AI review, under their API terms.
- GitHub and GitLab, when you connect an account and ask us to read code, post reviews or commit fixes.
- Hosting, database, email and analytics providers that run the Service on our behalf.
- Google, for analytics and advertising as described above.
- Your team: members of an organization can see that organization’s audits, scans and usage.
- Legal reasons: when required by law, or to protect the rights, safety and security of our users, the public or the Service.
- Business transfers: as part of a merger, acquisition or sale of assets, subject to this policy.
6. How long we keep information
We keep account information for as long as your account is active. Audits, scans and reports are kept until you or your organization delete them or close the account. When an account is deleted we delete its audits, scans and connected tokens, except where we must keep records (for example payment records) to meet legal obligations.
7. Security
We use encryption in transit, encrypted storage for git provider tokens, hashed passwords, access controls and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please report suspected vulnerabilities to noumanqureshi15@gmail.com.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you and get a copy of it;
- correct inaccurate information;
- delete your information or your account;
- object to or restrict some processing, including direct marketing;
- withdraw consent where processing is based on consent;
- complain to your local data protection authority.
California residents have the right to know what personal information is collected, to delete it, to correct it, and not to be discriminated against for exercising these rights. We do not sell personal information. To use any of these rights, email noumanqureshi15@gmail.com; we may need to confirm your identity first.
9. International transfers
Our service providers may process information in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses for those transfers.
10. Children
The Service is for professional use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. We will change the date at the top and, for significant changes, notify account holders by email or in the app.
12. Contact
Email noumanqureshi15@gmail.com or use our contact page.