> ## Documentation Index
> Fetch the complete documentation index at: https://battletest.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Data Handling

> How BattleTest accesses repository and scan data, which records are stored, encryption at rest and in transit, retention windows, and subprocessors.

## GitHub repository access

| Data                                               | Access               | Stored?                 |
| -------------------------------------------------- | -------------------- | ----------------------- |
| Repository source code                             | Read at review time  | Not persistently stored |
| Git diff / commit content                          | Read at review time  | No                      |
| PR description and comments                        | Not accessed         | No                      |
| Repository name and metadata                       | Read                 | Yes                     |
| Finding metadata (file path, line, type, severity) | Produced by analysis | Yes                     |

## Stored data

### PR review records

* Repository identifier (org/repo name)
* PR number and commit SHA
* Finding records: file path, line number, vulnerability type, severity, description, remediation
* Vector embedding of each finding description (used for regression detection)
* Risk score and plain-English summary

### Live scan records

* Domain and scan configuration
* Discovered endpoints and their response metadata (status code, headers)
* Finding records: endpoint, vulnerability type, evidence, remediation
* Scan run timeline and status

### Account data

* Email address
* GitHub OAuth identity (if GitHub sign-in used)
* Organisation membership and plan tier
* Settings and preferences

## Encryption

| Layer                               | Method                               |
| ----------------------------------- | ------------------------------------ |
| Data in transit                     | TLS 1.3                              |
| Data at rest                        | AES-256                              |
| Webhook payload signing             | HMAC-SHA256                          |
| API keys and session tokens at rest | Hashed (bcrypt)                      |
| GitHub webhook verification         | HMAC-SHA256 (GitHub-supplied secret) |

## Subprocessors

| Service       | Purpose                                                                                                                                                                                                                                                                              |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Cloudflare R2 | Report file storage                                                                                                                                                                                                                                                                  |
| Paddle        | Payment processing — card data never reaches BattleTest                                                                                                                                                                                                                              |
| DeepSeek      | AI analysis of code diffs for security review. Code diffs are transmitted to DeepSeek and processed under their Open Platform Terms of Service. DeepSeek does not currently publish a Data Processing Agreement or a public commitment on API data retention and training practices. |

<Note>
  We reserve the right to change our subprocessors at any time. When we add or change one,
  we email account holders to let you know, so you are always aware of who processes your
  data. See our [Privacy Policy](https://battletest.dev/privacy) for details.
</Note>

## Retention and deletion

* **Finding records and scan results:** retained for the lifetime of the account
* **Repository disconnection:** findings for that repository removed within 24 hours
* **Account deletion:** all associated data removed within 30 days
* **Data export:** available as JSON from the Dashboard at any time

## Security disclosures

Report vulnerabilities in BattleTest to [security@battletest.dev](mailto:security@battletest.dev). We follow coordinated disclosure and aim to respond within 2 business days.