Your data stays
yours. Period.

You are hiring an attacker, so controls come first: encrypted credentials, scoped access, nothing tested before proof of control.

Ask a security question

What AISEC uses — nothing more

Web app & API
Only targets inside your verified scope
GitHub
Only the repositories you select
Test accounts
Only the access you hand over, stored encrypted
See connections

Who can see
the results?

Only your workspace. Roles decide exactly who sees findings, evidence and settings.

Team access
Roles for every member; revoke access in one place.
Connected tools
You choose which Slack channel and Jira project receive findings.
Audit history
Every security-relevant change on record, on supported plans.

What happens
to the data?

AISEC processes target responses, the context you supply and the findings it produces — solely to run your assessment. This can include data sent to third-party AI providers.

Read the privacy policy
Stored credentials

Test credentials and secrets live in encrypted storage — never plaintext, never in scan logs. Use dedicated test accounts; revoke when done.

Revoking access

Disconnect integrations in AISEC and remove GitHub App access in GitHub — effective immediately for new tests. Messages and tickets already delivered remain in their destination.

Retention and deletion

Export everything we hold, or delete your account and its data entirely — both built in. See the privacy policy for retention periods; contact us for a DPA.

Testing permission

Only test systems you own or have permission to assess. AISEC checks proof of control — a DNS record only the domain owner can publish — before a single test packet is sent.

Reports and compliance

Findings map to OWASP, PCI DSS, ISO 27001, SOC 2 and ASVS controls. Reports provide evidence for remediation and audit work; they do not grant certification or guarantee that no vulnerabilities remain.

Strict requirements? Good.

DPA, custom retention, on-premise or your own cloud keys — Enterprise plans bend to your governance, not the other way around.

Contact security Terms of service