Security & privacy
Your source code is never written to our disk in plaintext. A short-lived worker clones, scans, encrypts the feature map with AES-256-GCM, then wipes itself — we hold ciphertext and a wrapped key, and the master key never leaves AWS KMS.
Privacy modes
Same data-flow shape, three visibility windows. Standard is what ships today; Private and Sovereign are on the roadmap, shown so you can see where the design is going.
Wystan seesFeature & flow names, the file-path index, metrics, and runtime counts from Sentry / PostHog.
EncryptedLine ranges, narrative descriptions, symbol attribution, dependency graphs — encrypted at rest with a per-org key.
Best forMost SaaS teams
Wystan seesOnly opaque UUIDs, aggregate counts, and commit timestamps.
EncryptedFeature & flow names, file paths, and everything from Standard — encrypted with your key; PR comments would then render outside our servers.
Best forFintech · healthcare · sensitive code
Wystan seesA periodic license-check ping — nothing else.
EncryptedEverything. Engine, dashboard, and Postgres would run entirely inside your VPC.
Best forBanks · defense · regulated industries
Encryption architecture
Envelope encryption: a per-scan data key encrypts the feature map, and that key is wrapped by our HSM-backed KMS master key, bound to {org, scan} so it is useless outside its scope. Decryption is server-side, for authorised reads only, and audit-logged. Customer-Managed Keys (roadmap) would let you revoke our decrypt access at any moment. Runtime data stays aggregate — counts and event IDs, never request bodies or PII.