Privacy Policy
Effective date: 2026-06-08 · Last updated: 2026-06-08
This Privacy Policy explains what data Verqen collects, how we use it, and your rights. It is written to be accurate and auditable — we do not claim controls we do not have.
1. Who we are
Verqen is an AI code-review service for typed codebases, operated by German Kosach, the Netherlands ("Verqen", "we", "us").
- General contact: [email protected]
- Privacy / data requests: [email protected]
- Security: [email protected]
For data-protection purposes, where Verqen processes your source code on your behalf, you are the data controller and we are the processor. For your own account and billing data, we are the controller.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, GitHub identity (username, account ID) | You / GitHub via Clerk |
| Repository metadata | Repo names, PR numbers, commit SHAs | GitHub App installation |
| Source code (transient) | PR diff + minimal surrounding context | Your repo, during a scan |
| Review findings | Location, severity, explanation, masked snippet | Generated by the engine |
| Billing data | Plan, payment status, invoices | Stripe |
| Usage & metering | Scan counts, aggregate token cost, feature usage | Our systems |
| Logs | Redacted operational logs (secrets masked) | Our systems |
We do not collect or store full copies of your repositories.
3. How we handle your source code
This is the part that matters most, so we state it plainly:
- For cloud scans we fetch the PR diff and minimal surrounding context through your org's GitHub App installation (least-privilege). We do not clone the full repository.
- That diff/context is sent to the configured LLM provider for analysis and is held only for the duration of the scan — it is not persisted afterward.
- We store findings (location, severity, explanation, a masked snippet), not a copy of your code.
- Our content-hash cache is keyed by commit SHA and caches findings, not raw code. Private-repo data is never cached across organizations.
- On the self-host / Enterprise tier you use your own LLM provider or a local model, and no code leaves your network.
By default, no human at Verqen reads your code — it flows machine-to-machine through the pipeline. Operator access for support or debugging is minimized, logged, and never used to train any model.
4. What we send to LLM providers
On the cloud tier, the PR diff + minimal context is sent to our LLM provider (Anthropic and/or OpenRouter) under their data-processing terms, including no-training / zero-retention options where the provider supports them. We never send full repositories — only what the diff review requires. On self-host / Enterprise, the provider is your choice and your contract.
5. How we use data
- To run code reviews and return findings to you (performance of contract).
- To operate, secure, and improve the service (legitimate interest).
- To bill you and prevent abuse (contract / legitimate interest).
- To contact you about service, security, or billing matters.
We do not sell your data, and we do not use your code or findings to train models.
6. Sub-processors
We use the following sub-processors. Business/Enterprise customers receive notice of material changes.
| Sub-processor | Purpose | Data exposed |
|---|---|---|
| Anthropic / OpenRouter | LLM review (cloud tier) | PR diff + context |
| Cloudflare | DNS, WAF, network edge, access | Request metadata |
| Hetzner | Hosting, compute, database, backups | Findings, metadata, transient scan data |
| Clerk | Authentication | Email, GitHub identity |
| Stripe | Billing | Billing data (no code) |
| PostHog | Product analytics | Usage events, account identifiers |
7. Data retention
| Data | Retention |
|---|---|
| PR diff / source sent for review | Duration of the scan only; not persisted afterward |
| Findings | Kept for dashboard history; deletable by you at any time |
| Content-hash cache | Keyed by commit SHA; findings only, no raw code |
| Logs | Redacted; retained for 30 days |
| Billing records | Retained as required by law/accounting |
You can delete your org's findings, disconnect repositories, or uninstall the GitHub App at any time. Uninstalling stops all reviews and marks repositories disconnected.
8. Your rights (GDPR and similar)
You have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent where processing is based on it. To exercise these rights, contact [email protected]. You may also lodge a complaint with your supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens).
9. International transfers
Hosting and database are in the EU (Hetzner). Some sub-processors (e.g. Anthropic) may process data outside the EEA; where they do, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
10. Security
- TLS in transit across all hops (GitHub to Verqen to LLM provider to browser).
- Encryption at rest for the database; secrets in a managed store.
- Strict tenant isolation: every record is scoped to your organization.
- Operator access is minimized and logged.
We describe the actual mechanisms in place. Verqen reduces risk in AI-generated code; it does not guarantee the absence of bugs or vulnerabilities, and should not be the sole gate for safety-critical systems.
11. AI transparency (EU AI Act)
Verqen is an advisory tool operated with human oversight: findings are suggestions and the developer decides what to act on. The system can miss issues and can produce false positives. It is one layer of review, not a substitute for security testing.
12. Cookies
We use strictly necessary cookies for authentication and session management (via Clerk), and product-analytics cookies (PostHog) to understand and improve the service. You can request opt-out of analytics at [email protected].
13. Data Processing Agreement
Business and Enterprise customers can request a Data Processing Agreement (DPA) at [email protected].
14. Changes
We may update this policy; the "Last updated" date reflects the latest version. Material changes will be communicated to account holders.