Legal / DPO / Compliance
Nothing the scan reads leaves the machine.
Skarn is built from first principles for regulated environments. The scan sends no personal data, no source code, and no credentials to any external party. Your most likely objections are answered by the architecture itself - before you review a contract.
The regulations, by purpose
The scan processes session content only on your machine and sends none of it to Skarn or any third party. Its reports mask every credential they show and stay on your own infrastructure. The privacy policy describes the account, license and payment data Skarn does hold.
NIS-2 asks organisations to manage their cyber risk, to show that the measures work, and it holds management accountable for them. Skarn's SARIF and JSON output is a record of what AI coding sessions exposed and that someone checked.
DORA asks financial entities to own their ICT risk and to identify the weaknesses in their systems. Credentials exposed in AI coding sessions are one such weakness, and Skarn finds them.
The AI Act sets rules for AI systems and the organisations that use them. Where you keep a record that AI activity is monitored, --audit-log (Pro) appends a hash-chained record of each scan: timestamp, policy, finding counts, verdict, no secrets.
The CRA asks software manufacturers to develop securely, to take care over the components they ship, and to report serious incidents. Skarn supplies development-process evidence for those duties: redacted findings from AI coding sessions, dependency context those sessions observed, and a hash-chained audit record when audit logging is on. It is not a conformity assessment and not a claim that a product is compliant.
Data handling, factual summary
| Item | Status |
|---|---|
| Scan content sent to Skarn | None. Account, license and payment data are described in the privacy policy |
| Cloud dependency for the scan | None |
| Credentials shown in plaintext in reports | Never - always masked |
| Telemetry or usage data | None from the scanner. Website analytics and portal records are described in the privacy policy |
| Data processing agreement for the portal | Published at getskarn.com/terms/dpa/; takes effect with a Team or Enterprise order |
| Optional online checks | Opt-in only - off by default |
More for your team: CISO and CSO, CEO and Board, Procurement
Book a live demo
A 30-minute live demo for Legal and the DPO: the architecture and the data-handling position, document by document.