Security and your data

Isolation between organisations

Every organisation's data is separated by the database itself, not only by application code: each table enforces row-level security, and every query runs with your organisation set for that transaction alone. A query without it sees nothing.

What Akesis reads, and what it keeps

• Scanner results: findings and their details, from your scanners and code hosts.
• Pull requests and CI results on the repositories you connect.
• Your code, for reachability only: for npm projects, Akesis reads the lockfile, package.json and production JavaScript and TypeScript from the default branch's archive as it streams, keeps the verdict and its evidence (one line, such as an import chain), and stores none of the code.
• Coverage: only the percentage per commit, never the report.
• Code structure: if your CI sends a Graphify graph, Akesis keeps only which files and functions use each package, never the graph or the code.
• SARIF: secrets the scanner matched, licence results and absolute build paths are left out.
• Strix: exploit scripts are never sent to Akesis.

Credentials

Tokens and webhook URLs you enter are encrypted (AES-256-GCM) with keys that live outside the database, bound to your organisation and to their purpose, and never shown again. Upload keys and assistant tokens are stored only as hashes. Sign-in sessions are server-side, and cookies hold only a random token.

AI

AI is used only for risk narratives. Models never see your source code; they see facts Akesis already holds about a finding. Requests run on Amazon Bedrock in your organisation's region (EU organisations in the EU), prompts aren't logged, and your data is never used to train models.

Where data is stored

Your data is stored in one database region, in the United States (AWS us-east-2). The EU setting governs where AI processing runs; it doesn't move stored data. EU data storage is coming soon; talk to Valitura if you need it. The companies that store and process data for Akesis are listed on the sub-processors page, and our Data Processing Agreement applies to every customer.

Access Akesis asks for

On GitHub, an app with read and write access to code and pull requests and read access to alerts and CI, and no administration permission. Every change arrives as a pull request, through your branch protection. On GitLab and Bitbucket, the access tokens you create; see Code hosts.