Privacy Note

Part A — The product

1. Nothing is collected

VerdictGit contains no telemetry, no usage analytics, no crash reporting and no automatic update checks. It does not create an account with us, because there is no "us" for it to talk to: the Software runs entirely on infrastructure you operate.

2. Your data stays where you put it

Scanner reports you ingest, the findings derived from them and every verdict your team writes are stored in your environment — verdicts as YAML files in a git repository you own. None of it is transmitted to the vendor, at install time or ever.

3. The complete network picture

The Software can print its entire network inventory on demand: run verdictgit egress-report on your install. On a default install, that report lists zero destinations. That report — not this page — is the authoritative list, and it is test-pinned in the product's build so it cannot quietly drift from the truth.

4. Optional integrations are yours to switch on

The only network activity the Software can ever perform is what you configure yourself:

• OIDC single sign-on — if you configure it, the Software talks to your identity provider so your team can log in.
• Jira sync — if you configure it, the Software talks to your Jira instance, carrying the verdict summaries you chose to sync.
• OSV snapshot refresh — only when you run it, the Software downloads the public OSV vulnerability dataset (data flows in; your findings are never uploaded as part of a refresh).

5. Licence verification is offline

Licence keys are signed keys checked locally against a public key in the binary. There is no activation server, no licence phone-home and no device fingerprinting. A key can be verified in an air-gapped room, because it is.

6. If you send us something, that is your choice

The one way product-related data can reach us is if you deliberately send it — for example, attaching a report excerpt to a support email. We will use anything you send only to answer the question you sent it with.

Part B — This website and buying a licence

7. This website

This site is a set of static pages. It sets no cookies, runs no third-party scripts or trackers, and loads no external resources — even the fonts are served as local files. The pages are hosted by Cloudflare, which, like any web host, processes visitor IP addresses in standard server logs in order to deliver and protect the site.

8. Analytics, if enabled

If analytics are enabled on this site, they are provided by Cloudflare Web Analytics: cookie-free, aggregate counts — pages viewed, rough geography, referrers. There are no individual visitor profiles, no cross-site tracking and no advertising identifiers. If analytics are not enabled, nothing of the sort is collected at all.

9. Buying and enquiring

Payments are processed by our Merchant of Record — a payment provider that acts as the seller of record, handles card processing, sales tax and VAT, and issues your invoice. From a purchase, we receive your name, company, email address and country, plus whatever is needed to issue and deliver your licence key. We never receive, see or store your card number — it goes from you to the payment provider and nowhere else.

If you email us an enquiry, we use your address only to answer that enquiry and, if you go ahead, to deliver your licence. Enquiries are not added to a marketing list.

10. What we never do

• We never sell personal data, to anyone, for any reason.
• We never share it except with the payment provider (to take payment and issue your invoice) and the email service we use to reply to you and deliver keys.
• We never receive data from the product itself — see Part A; there is nothing to share.

11. Retention and your rights

Purchase records are kept for as long as tax and accounting law requires, because invoices have to be. Enquiry emails are deleted once they are no longer needed to deal with the enquiry. You may ask us at any time what personal data we hold about you, and ask for its correction or deletion; write to the address published on this website and we will deal with it personally.

12. Changes

If this note changes, the new version will appear here with a new date at the top. The product half of it — Part A — describes how the Software is built and test-pinned; it cannot change silently underneath an installed copy.