How Strix Protects Your Code and Data
A security product that cannot explain its own security posture is not a security product. Here is how Strix handles your code, credentials, and findings data.
Least-Privilege Access by Design
Strix requests the minimum access required to perform each analysis step. Source code is read-only. No write access is ever requested on your repositories or cloud accounts.
Read-Only Repository Access
GitHub, GitLab, and Bitbucket integrations are provisioned with read-only OAuth scopes. Strix never writes to your repositories, creates branches, or opens pull requests.
Scoped IAM Roles
Cloud scanning uses a cross-account IAM role with a scoped policy we provide. The policy allows reading IAM configurations, security groups, and S3 ACLs. No network access, no data plane permissions.
Isolated Scan Environments
Each scan runs in an isolated execution environment that is destroyed after the scan completes. Scan environments have no access to other customers or persistent storage.
Credential Handling
API tokens and cloud credentials are encrypted at rest using AES-256 and in transit using TLS 1.3. Credentials are accessed only during active scan sessions and are never logged or exposed in findings output.
What Strix Stores and for How Long
Your source code is not stored. Strix processes it in memory during the scan and discards it afterward. Only findings metadata is retained.
Source Code
Fetched during scan execution and processed in memory. Not written to persistent storage. Discarded when the scan environment is destroyed. You can verify this via the access log in your VCS provider.
Findings Data
Finding records (vulnerability type, severity, affected component, chain trace) are stored in your Strix workspace for the duration of your subscription plus a 90-day offboarding window. Exportable at any time.
Scan Logs
Execution logs are retained for 30 days for debugging purposes. Logs contain scan metadata and timing information. They do not contain code snippets, credential values, or finding details.
Data Residency
Strix infrastructure operates in US-based AWS regions. EU data residency options are on the roadmap for Q4 2026. Contact us if your compliance requirements need a specific residency commitment.
Built with SOC 2 controls in mind
We are an early-stage company and have not yet completed a formal SOC 2 audit. We have implemented the access controls, audit logging, and incident response procedures that SOC 2 Type II requires. Formal certification is on the roadmap as we scale.
Strix scan output is structured and timestamped to serve as pentest evidence for SOC 2, PCI DSS Section 11, and ISO 27001 Annex A.12 requirements. Questions about controls? We will walk you through what we have in place.
Talk to Our Security Team