Privacy Policy
Effective date: 2026-09-30 · Last updated: 2026-09-30
This Privacy Policy explains what data Verqen collects, how we use it, and your rights. It is written to be accurate and verifiable — we do not claim controls we do not have.
1. Who we are
Verqen is an AI code-review service for typed codebases, operated by German Kosach, the United Arab Emirates ("Verqen", "we", "us").
- Contact, including privacy, data and security requests: [email protected]
For data-protection purposes, where Verqen processes your source code on your behalf, you are the data controller and we are the processor. For your own account and billing data, we are the controller.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, GitHub identity (username, account ID) | You / GitHub via Clerk |
| Order connection | GitHub account login, installation ID and the repositories the installation allows | GitHub, when you connect an order |
| Repository metadata | Repo names, GitHub repository IDs, PR numbers, commit SHAs | GitHub App installation |
| Source code (transient) | Repository archive at the checked commit, read in memory | Your repository, during a run |
| Run results | Rule, condition, file, line and a one-way hash of the flagged line | Produced by the check |
| Platform check results | Rule, condition, file and line of each triggered rule on your pull requests, with the rule title and explanation copied from the catalog | Produced by the check on the Verqen platform |
| Order data | Price, client country, payment document number, contact | Our records |
| Usage & metering | Scan counts, aggregate token cost, feature usage | Our systems |
| Logs | Redacted operational logs (secrets masked) | Our systems |
We do not collect or store full copies of your repositories.
When you connect an order, GitHub asks you to authorize Verqen. The access token GitHub returns is used once to read which installation and repositories you chose, is not stored, and is revoked right after.
3. How we handle your source code
This is the part that matters most, so we state it plainly:
- For an order, the engine downloads the repository archive of the checked commit through the GitHub App and reads it in memory. It is not written to disk and not stored after the run.
- We store only the run result: for each triggered rule, the rule, the condition, the file and the line. On the Verqen platform, the same applies to checks of pull requests: the code is read for the check, and only the triggered rules, their locations and the rule text copied from the catalog are stored.
- To compare a repeat run with the previous run of the same repository, each result also keeps a one-way hash of the flagged line, salted with the repository ID. The line itself is not stored.
- No person at Verqen reads your code. It is never used to train any model.
4. What we send to model providers
The code the check needs is sent through OpenRouter to the model providers it routes to, under their data-processing terms. We never send it anywhere else.
5. How we use data
- To run the check and return the run result to you (performance of contract).
- To operate, secure, and improve the service (legitimate interest).
- To bill you and prevent abuse (contract / legitimate interest).
- To contact you about service, security, or billing matters.
We do not sell your data, and we do not use your code or run results to train models.
6. Sub-processors
We use the following sub-processors. Customers receive notice of material changes.
| Sub-processor | Purpose | Data exposed |
|---|---|---|
| Hetzner | Hosting, database, backups | Run results, order data |
| Cloudflare | DNS, network edge, access | Request metadata |
| OpenRouter and the model providers it routes to | Automated check | Source code of the checked commit, transiently |
| GitHub | Repository access, GitHub Check | Repository metadata, run results |
| PostHog | Product analytics and error reports | Usage events, identifiers |
| Clerk | Authentication for the Verqen platform | Email, GitHub identity |
7. Data retention
| Data | Retention |
|---|---|
| Source code | Duration of the run only; not stored |
| Run results | Kept for the order record |
| Platform check results | Kept for the history of your organization on the platform; deleted on request |
| Logs | Redacted; kept in size-limited files that are overwritten as new entries arrive |
| Billing records | Retained as required by law/accounting |
You can uninstall the GitHub App at any time; that ends all access to your repositories.
8. Your rights (GDPR and similar)
You have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent where processing is based on it. To exercise these rights, contact [email protected]. You may also lodge a complaint with your supervisory authority (in Georgia, the Personal Data Protection Service).
9. International transfers
Hosting and database are in the EU (Hetzner). Some sub-processors (e.g. the model providers OpenRouter routes to) may process data outside the EEA; where they do, transfers are covered by appropriate safeguards such as Standard Contractual Clauses.
10. Security
- TLS in transit across all hops (GitHub to Verqen to model provider to browser).
- Database backups are encrypted before they leave the server. Secrets are kept in a server configuration file readable only by the server administrator.
- Strict tenant isolation: every record is scoped to your organization.
- Operator actions through the admin tools (orders, payments, plan changes, suspensions) are recorded in an action log.
We describe the actual mechanisms in place. Verqen reduces risk in AI-generated code; it does not guarantee the absence of bugs or vulnerabilities, and should not be the sole gate for safety-critical systems.
11. AI transparency (EU AI Act)
Verqen is an automated tool. It runs without human involvement and applies a published rule catalog; it can miss issues and can report conditions that are not problems in your context. It is not a substitute for security testing.
12. Cookies
We use strictly necessary cookies for authentication and session management (via Clerk), and product-analytics cookies (PostHog) to understand and improve the service. You can request opt-out of analytics at [email protected].
13. Data Processing Agreement
Customers can request a Data Processing Agreement (DPA) at [email protected].
14. Changes
We may update this policy; the "Last updated" date reflects the latest version. Material changes will be communicated to account holders.