Prasovi Privacy Policy

Last updated: September 25, 2026

1. Who We Are

Prasovi ("we", "us", "our") is a security scanning platform that helps you find vulnerabilities in your code repositories and audit your cloud infrastructure for misconfigurations.

2. Information We Collect

Account information: When you sign up, we collect your name, email address, and password (stored as a secure hash, never in plain text). You may optionally provide your mobile number, company name, and address.

Provider credentials: To scan your repositories and infrastructure, you provide credentials for the services you choose to connect: access tokens for GitHub and GitLab (including self-hosted instances), Bitbucket, and Azure DevOps; AWS access keys, an Azure service principal, or a Google Cloud service account key; and a kubeconfig for Kubernetes clusters. These are encrypted at rest using industry-standard encryption before being stored, and are only decrypted when needed for an action you requested, such as listing your repositories or running a scan, or for scheduled tasks you've enabled, such as container registry rescans. Container registry monitoring uses your connected AWS, Azure, or Google Cloud credentials; for it we store only the image references you add.

CI/CD API tokens: Tokens you create for the CI/CD gate are stored only as a one-way hash. The token itself is shown to you once, when you create it.

Scan data: We store the results of scans you run — findings such as detected secrets, code vulnerabilities, dependency issues, and infrastructure misconfigurations — along with metadata like which repository/account was scanned and when. Each finding records the tool, severity, rule, a description, and where it was found (such as a file and line). For secrets found by our secret scanners (Gitleaks and TruffleHog), we store only where the secret was found and which rule matched — never the secret value itself. If a detected secret exactly matches a cloud credential you have connected, the finding also records which of your connected cloud accounts it matches.

Payment information: Payments are processed by Razorpay, our third-party payment processor. We do not store your full card or bank details — Razorpay handles this directly under their own security and compliance standards (PCI-DSS). We retain only subscription status, plan, and billing period information.

Usage data: We log login attempts (for security, e.g. detecting brute-force attempts), scan history, and basic technical information like IP address and browser type for operational and security purposes.

3. How We Use Your Information

To provide the scanning service you've signed up for
To authenticate you and secure your account
To process payments and manage your subscription
To send you transactional emails (email verification and password resets) via our email provider, Resend. We don't send billing emails ourselves; Razorpay, our payment processor, may email you payment links and receipts directly
To detect and prevent abuse (e.g. login lockouts after repeated failed attempts)
To improve and maintain the platform

We do not sell your personal information to third parties. We do not use your code, scan results, or credentials for any purpose other than providing the service to you.

4. Third-Party Services We Use

GitHub, GitLab, Bitbucket, Azure DevOps — to access repositories you explicitly connect, using credentials you provide
AWS, Microsoft Azure, Google Cloud, and your Kubernetes clusters — to access cloud resources and container registries you explicitly connect, using credentials you provide
Razorpay — payment processing
Resend — transactional email delivery
Render — application hosting infrastructure
PostgreSQL (hosted on Render) — database storage
Cloudflare — DNS and network proxy; traffic to prasovi.com passes through Cloudflare
Google Fonts — web fonts used by our pages, which your browser loads from Google
Semgrep and Aqua Security (Trivy) — our code scanner downloads its public rule set from Semgrep's registry, and our dependency scanner (Trivy) downloads its public vulnerability database, published by Aqua Security; no code or findings are sent to either vendor

Each of these providers has its own privacy policy governing how they handle data on their end.

5. Data Retention

We retain your account and scan data for as long as your account is active. If you delete your account, we permanently delete your profile, connected provider credentials, scan history, and findings from our systems. This action cannot be undone.

Two kinds of records are kept after an account is deleted, with no link to the account:

Trial-claim records: the identifiers of repositories, cloud accounts, and Kubernetes clusters that received free trial scans (such as a repository's ID or path, or a cloud account ID), with the account that used them removed. We keep these to prevent the same target being used for repeated free trials. These records are retained.
Sign-up rate-limit records: the IP address and time of each sign-up attempt, used to limit automated account creation. These records are retained.

Copies of deleted data may persist in our hosting provider's backups for a limited time before being overwritten.

6. Your Rights

You can access, update, or delete your account information at any time through your account settings. You can disconnect any provider integration (GitLab, GitHub, etc.) at any time, which removes the stored credential. You can request a copy of your data or ask questions about our data practices by contacting us at [email protected].

7. Security

We use encryption for sensitive data at rest (including provider credentials), secure password hashing, brute-force login protection, and access controls to protect your information. However, no system is completely secure, and we cannot guarantee absolute security.

8. Cookies

We use a session cookie to keep you logged in. We do not use advertising or tracking cookies.

9. Children's Privacy

Prasovi is not directed at individuals under 18. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this policy from time to time. We'll update the "Last updated" date above when we do. Continued use of Prasovi after changes means you accept the updated policy.

11. Contact Us

Questions about this policy? Contact us at [email protected].

← Back to home