What happens to your code and your details.

Proovant is a small, independently operated service. This page says plainly how your code and your personal details are handled, including the parts that are not as strong as we want them to be yet. Last updated: 11 November 2026.

Your code

How we get it

You send a repository link. For a public repository we clone it. For a private one we agree read-only access with you after the scope is accepted. We do not ask for write access, deploy keys with write rights, private keys, or production credentials, and you should never send them.

Where it is processed

• A private workstation. The repository is cloned to a workstation operated by Proovant. The analysis agents run there, and your code is compiled and its tests are run there.
• Anthropic. The agents are Anthropic's Claude models, run through Claude Code. To analyse your code, parts of it are sent to Anthropic's service. Anthropic's commercial terms and privacy policy apply to that processing. Ask us if you need the current details before you send anything.
• Storage. Your repository, the test copies of your code, working notes and reports are kept on the workstation's local disk, in a folder that is not synced to a cloud storage service. The review engine itself, which holds no client code, is backed up to cloud storage.

No other AI provider or third party receives your code.

What the review produces

A scope map, working notes on every lead (including rejected ones), proof-of-concept tests, test logs and the report. These are kept with your code and deleted with it.

What is not isolated yet

Building and testing your code happens on the same workstation as other work, not in a separate environment per client. We review only repositories we are willing to build locally. A per-client isolated environment is planned and is not in place today.

Who can access it

The researcher operating the review. On the Verified plan that is also the person who checks the findings. Nobody else at Proovant, and no other customer, has access. Anthropic processes the data as described above.

What we learn from your review

The engine uses a knowledge base built from public audit findings. Your code and your findings are not added to it. After a review we may add a general lesson to our internal checklists, such as a class of bug we were slow to spot. Those notes do not contain your code or name your project.

How long we keep it

• Source copies, working notes and test files: deleted within 30 days of delivering the report, unless you ask us to keep them for a retest or a fix review.
• The final report and PoC package: kept so that we can answer questions and review fixes. Deleted on request.
• Enquiry emails (what you send us before becoming a client): kept for up to 12 months, then deleted, unless you become a client.

Asking for deletion

Email info@proovant.com from the address you used with us and say what you want deleted. We delete it from the workstation and its backup and confirm by email within 7 days. Data already processed by Anthropic is handled under Anthropic's own retention terms, which we do not control.

Confidentiality and disclosure

• Findings are sent only to the contact you name.
• We do not name a client or publish a finding without written permission. Cloak is named on this site because the team published the outcome of its review.
• The totals on this site, such as the number of reviews and findings, are anonymous.
• If we find an issue that is being actively exploited or that affects other protocols, we tell you first and agree next steps with you.

This website

• No form. This site has no enquiry form and collects nothing itself. You contact us by email, and we use what you send only to reply to you.
• Cookies and tracking. None. There is no analytics script and no advertising tracker.
• Fonts. Typefaces load from Google Fonts, so your browser contacts Google when a page loads.
• Hosting. The site is served through Cloudflare, which may log requests (such as your network address) for security and performance under its own privacy policy.

What we do not claim

• No SOC 2, ISO 27001 or similar certification, and no independent assessment of our own setup.
• No guarantee that a review finds every vulnerability. A report is not an audit certificate.
• No legal agreement is in place until you accept a quote. If you need a non-disclosure agreement first, mention it in your first email.

Report a security problem with this site

If you find a security problem in this website or in how we handle data, email info@proovant.com with the details. Please give us time to fix it before you share it publicly.

Contact

Questions about this page: info@proovant.com.