How We Handle Your Code and Data

DRAFT — not legal advice. This is a plain-language working draft for review. Have a qualified lawyer review it before you rely on it or publish it. Anything in [BRACKETS] is a placeholder or a decision still to make (see our open-questions list).

Last updated: [DATE]
Operator: HOC Techlabs LLP, trading as Safe Hands.

To audit your app, we need to read your code. This page explains exactly what access we ask for, what we do with your code, how long we keep it, and how to cut us off at any time.

1. The access we ask for

We connect through the Safe Hands GitHub App [PLANNED — until it's live, we'll agree an access method with you in writing]. When you install it, GitHub shows you the exact permissions before you approve. You choose which repositories it can see. Pick "Only select repositories" and choose just the one you want audited.

What we don't ask for:

• No organisation admin or member management.
• No access to repository settings, secrets, deploy keys, webhooks, or GitHub Actions.
• No access to your other repositories, unless you select them.
• No permission to merge. We never push to your main branch. Every change arrives as a pull request that you review and merge yourself.

Tip: turn on branch protection for your main branch. That makes GitHub enforce that nothing lands there without your approval.

2. How we use your code

• For your audit only. We read your code to find and fix security problems in your app. Nothing else.
• Never for AI training. We don't use your code, data, or findings to train AI models, and we don't let our providers do so either.
• Never shared or published. We treat your code as confidential (see Terms, section 9).
• People involved: only the Safe Hands reviewers working on your audit can see your code.

AI tools we use

We may use AI tools to help with the review. A person checks every finding and every fix. We only use providers that, under their terms, don't train on the data we send. Our current providers are:

We'll update this list before adding a new provider. If you'd rather we didn't use AI tools on your code, tell us before we start and we'll agree how to proceed.

3. Where your code lives while we work

• We make a temporary copy (a "clone") of the repository on a dedicated, secured virtual machine ([REGION]). Each audit starts from a fresh copy.
• We don't copy your code into email, chat tools, or shared drives.

4. How long we keep things

You can ask us to delete your data early at any time by emailing support@safehands.dev. We'll confirm once it's done.

5. Secrets we find in your code

Apps built quickly often have passwords, API keys, or tokens in the code. If we find any:

• We report them to you in the audit, showing only enough to identify them (for example the first few characters).
• We never use them. We don't log in to your services, call your APIs, or touch your live data with them.
• We never store them anywhere except inside the temporary copy of your code, which is deleted on the schedule above.
• We'll tell you to rotate them (replace them with new ones), because anything that has been in your code should be treated as exposed. Removing a secret from the code doesn't remove it from your Git history.

If we find a secret that looks actively dangerous (for example a live admin key), we'll tell you straight away instead of waiting for the report.

6. How to remove our access

You can cut off our access at any time, in less than a minute, without asking us.

Repository on your personal account:

1. On GitHub, click your profile picture (top right) and choose Settings.
2. In the left sidebar, under Integrations, click Applications.
3. Open the Installed GitHub Apps tab.
4. Next to Safe Hands, click Configure.
5. Scroll to the bottom ("Danger zone") and click Uninstall, then confirm.

Repository owned by an organisation (you need to be an organisation owner):

1. On GitHub, click your profile picture and choose Your organizations.
2. Next to the organisation, click Settings.
3. In the left sidebar, under Third-party Access, click GitHub Apps.
4. Next to Safe Hands, click Configure.
5. Scroll to the bottom and click Uninstall, then confirm.

To remove access from one repository only: follow the same steps, but under Repository access remove that repository and click Save instead of uninstalling.

Uninstalling takes effect immediately. GitHub won't let us read your code or open pull requests after that. Pull requests we've already opened stay in your repo until you close them. Uninstalling doesn't delete the copies we've already made, which follow the retention schedule above. Email us if you want them deleted straight away.

7. Security on our side

• Access to customer code is limited to the people working on it, with two-factor authentication on all accounts.
• Our work machines and storage are encrypted.
• The GitHub App's private key is stored securely and rotated [SCHEDULE].

8. If something goes wrong (breach notification)

If we discover that your code or data has been accessed by someone who shouldn't have it while it was in our care, we will:

1. Tell you within [72] hours of finding out, by email to the contact you gave us.
2. Explain what happened, what was affected, and what we're doing about it.
3. Tell you what you should do, for example which secrets to rotate.
4. Keep you updated until it's resolved, and meet any legal notification duties that apply.

9. Questions and requests

Email support@safehands.dev to ask a question, request deletion, ask for an NDA, or report a security concern.

HOC Techlabs LLP · Kethana Accolage, Sarjapur Main Road, Bengaluru, Karnataka 560035, India