How Octopoda handles your code and data

Where your code goes during an Octopoda scan, how the sandbox is isolated, which AI provider sees it, how long data is kept, and how to report an issue.

Octopoda needs to read and run your code to test it, so it is built to keep that code private: every scan runs in its own sandbox, your code is deleted when it is no longer needed, and it is never used to train AI models. This page explains what happens to your code, from upload to deletion.

​

How your code reaches a scan

• From the CLI or MCP server: the CLI packs the project, leaving out .env files and private keys, and uploads it over HTTPS. See Choose what gets scanned.
• From GitHub: the scan downloads the repository with a token that is read-only, limited to that one repository, and expires after an hour.

​

The scan sandbox

Each scan runs in its own isolated virtual machine, started for that scan alone and destroyed when it ends. Nothing in it is kept.

• No access to other customers or to Octopoda’s systems. The sandbox holds no secrets except a token that can only report on its own scan.
• Restricted network. The sandbox can reach only what a scan needs: Octopoda’s own API and AI gateway, GitHub, public package registries to install your dependencies, vulnerability databases, and error reporting. It cannot send requests anywhere else, including to your deployed app.
• Spending limits. Each scan has a hard limit on time and on AI usage, enforced outside the sandbox.

​

AI processing

The agent that tests your code uses models from OpenAI, through OpenAI’s API. Under OpenAI’s API terms, your code and results are not used to train OpenAI’s models; OpenAI may keep them for a limited period to monitor for abuse. Octopoda does not use your code or findings to train AI models either.

​

What is kept, and for how long

Data	Kept for
Code uploaded by the CLI or MCP server	Deleted automatically within 7 days
The scan sandbox and everything in it	Destroyed when the scan ends
Findings, code excerpts and scan history	Until you delete them or your account
Database backups	Up to 30 days

You can delete all scan data, or your whole account, at any time. See Delete your data.

​

Who can see your results

• People in your Octopoda account. See Teams and roles.
• Anyone with access to the repository on GitHub can see the checks and comments on pull requests you have asked Octopoda to check.

For everything Octopoda collects and the companies that process it, see the Privacy Policy.

​

Report a security issue

If you find a security issue in Octopoda itself, email [e-mail] with the subject “Security”. Please don’t test against other customers’ data.