Skip to main content

Data handling in Vulkro Cloud

This page summarises how Vulkro Cloud handles your data. The binding terms are in the Vulkro Cloud data processing page, and the controls behind them are on the Security page.

The scanner on your machine is different: the CLI, the VS Code extension and the local console scan on your machine, and your code stays there. This page covers only what you connect to Vulkro Cloud.

Isolation​

  • One workspace per customer, with its own database, its own storage and its own encryption key.
  • One container per scan. Each scan runs in its own container, and by default each scan job may reach only an allow-list of hosts: the workspace's results store, the repository's own git host, the public OSV database when live lookups are on, and, when the scan needs it, Vulkro's licence service.
  • Code exists only for the scan. A repository is cloned read-only and shallow into the scan's container, and the clone is deleted when the scan ends.

What Vulkro Cloud reads and writes​

Salesforce orgs: read-only. Vulkro Cloud reads your org's configuration and metadata, its code, users and their permissions, login history and IP addresses for threat detection, and record counts. It never reads the contents of your business records, and it never changes the org. See Connect Salesforce orgs.

Code repositories. Vulkro Cloud reads the code and the CODEOWNERS file. It writes back only what you turn on for that repository: commit statuses, checks and pull-request comments, and, when you ask, a fix pull request (opt-in per repository). See Connect repositories and Pull requests.

What it stores from a scan: the findings with their code excerpts (unless you turn excerpts off), the endpoints, the database schema (table and column names and their sensitivity, never the data in them), the dependency list, and secret findings.

Live vulnerability lookups (OSV)​

To find known vulnerabilities in your dependencies, including advisories published since the last scan, Vulkro Cloud checks each repository's dependencies against the public OSV vulnerability database (api.osv.dev, operated by Google), during every scan and once a day between scans.

  • What is sent: the package ecosystem, name and version of each dependency. Private package names are included. Code is never sent.
  • Default: on.
  • To turn it off: Workspace Settings > Data & Privacy > Live Vulnerability Lookups. With it off, Vulkro Cloud makes no call to OSV at all.

On the CLI the same lookup is off by default and turned on per run with VULKRO_CVE_LIVE=1 (see Dependencies and CVEs).

Data & Privacy settings​

Workspace Settings > Data & Privacy holds:

  • Result Retention: scan results are kept for 180 days by default. Choose from 7 days to 3 years (1095 days); how long you can choose is limited by your plan's history.
  • Store Code Snippets with Findings: on by default. Turn it off to keep no code excerpts.
  • Mask Personal Data in Results: on by default for new workspaces.
  • Live Vulnerability Lookups: see above.
  • Data Region: shown for information. There is no choice of data region.

Retention and deletion​

  • Sign-in IP addresses are pruned on the same schedule as the workspace's result retention.
  • Deleting an org (Orgs > Manage > Delete org) removes all of that org's scans, results, issues and evidence. The activity log entry for it is kept.
  • Export All Data: an owner can export one file with everything the workspace holds (stored secrets are never included). The file is kept for 7 days.
  • Deleting the workspace starts 14 days after an owner requests it; until then any owner can cancel it. When a workspace is closed, its offboarding export is kept for 30 days.
  • Your account: you can delete your own account from the customer portal (Settings > Profile). Billing and consent records are kept with your name and email removed.
  • Backups: the workspace database is backed up with point-in-time recovery only.

The full terms​

The Vulkro Cloud data processing page has the full terms, and the Privacy policy covers your account.

Last updated on