CodeFactor

Security Measures

• Authentication method is based on OAuth tokens;
• User tokens are encrypted before storing to database. AES with 256 bit key is used. Implementation is based on .NET Framework Class Library;
• Incident response plan is based on Incident Response Consortium playbooks;

File systems and communication

All access to the CodeFactor website as well as source code retrieval for GitHub and Bitbucket is restricted to HTTPS encrypted connections.

CodeFactor never collects or stores passwords for external applications like GitHub, Bitbucket, Google, etc. Integration with third-party apps is done via either OAuth or API keys.

Repository data is stored on CodeFactor's production servers until deleted by the user. This can be done at anytime by deleting an individual repository or by deleting the account that owns a repository. We do not retroactively delete data from our backups, as we may need to restore data if it was removed accidentally.

Server location

All servers are hosted on Microsoft Azure within the region of United States. Other third-party SaaS: Google Analytics, Google Drive, SendGrid.

Employee access

No CodeFactor staff will access private source code unless required for support reasons. In cases where staff must access source code in order to perform support, we will get user's explicit consent each time, except when responding to a critical security issue or suspected abuse.

When working a support issue we do our best to respect user's privacy as much as possible, we only access the minimum files and settings needed to resolve user's issue. Staff does not have direct access to clone your repository.

Data Retention and Deletion

Data is kept for the time necessary to provide the products or services requested by the customer. When user deletes their account, we will delete their personal data and it will expire from backups; unless we are legally allowed or required to maintain certain personal data, including situations under the applicable laws to reveal personal data upon reasonable request of public authorities.