Trust & Privacy

How we handle your data

Clean-Core.io is a free, community-built tool. Trust is earned by being specific, so this page states plainly what we store, where, and what rights you have — no legalese padding. (Reflects v3.0.19.)

Data residency — EU-hosted

Application storage and primary processing run in Google Cloud Firestore and Cloud Run in europe-west1 (Belgium, EU). AI processing (Google Gemini API) and transactional email (Resend) are disclosed subprocessors that may process data under their own terms and transfer safeguards.

Where your code goes

The findings, the extensibility route and the Clean Core Score are computed by our own engine on our server; no model takes part in them. Only the steps that write text — the analysis narrative, business names and sentences, the design, the code proposal, the documentation and the test suite — send your code to a language model, and always from our server, never from your browser. Which provider receives it depends on the key:

No own key, or your own Google Gemini key — the code goes to the Google Gemini API. Gemini API Additional Terms of Service · Google Privacy Policy

With your own key set, no call of your account uses the platform key: if your key is missing or the provider refuses it, the step stops and says so. Settings shows, per stage, which provider, model and key answered last, and the audit pack and the delivery package's STATUS.md name the provider, model and key owner of the signed analysis.

Code that may not leave: run the analysis without a model, and switch the model stages off in Settings. The deterministic evidence — findings, route, Clean Core Score — is complete and signed either way, and no code is sent to any model provider.

Encryption of sensitive data

S/4HANA credentials (BYOT) and your own model API key (BYOK, Gemini or Anthropic) are encrypted at rest with AES-256-GCM in a server-only collection that client apps cannot read. Passwords/keys follow a write-only pattern — they are never returned to the browser.

Two-factor sign-in uses Firebase Authentication's own TOTP factor, enrolled by your browser against Firebase directly — no secret and no code ever reaches our server. There are no backup codes; if you lose your authenticator, write to us from your account address and an administrator removes the factor after confirming with you, so you can set it up again.

Server-authoritative evidence

Every analysis is frozen into an immutable, HMAC-signed Run. Audit packs carry a SHA-256 manifest and signature so a third party can verify integrity independently. We label verification honestly: authentic → integrity-only → failed — we never show a green check we cannot back up cryptographically.

Subprocessors

Google Cloud / Firebase (EU, europe-west1) — hosting (Cloud Run) and database (Firestore).
Firebase Authentication — sign-in; a Google service not tied to a region, covered by the international-transfer safeguards in the privacy policy.
Google Gemini API — AI transformation of the code you submit for analysis.
Resend — transactional email (access approvals/notifications).

We add no advertising or analytics trackers that sell your data.

Security controls

Server-side auth on all mutating routes, admin gating with an allowlist, multi-layer SSRF defense on S/4HANA connections, a strict Content-Security-Policy, DOMPurify sanitization, and server-side quota/rate limiting. Supply-chain hygiene (secret scanning, dependency audit, SBOM) runs in CI. Full detail in how it works and the project's SECURITY documentation.

Your rights — including erasure

You can export your evidence at any time. Under GDPR Art. 17 you can delete your account from Settings; a server-side cascade permanently removes your profile, projects, analysis runs, uploads, encrypted S/4HANA and BYOK credentials, and MFA data. The completeness of this deletion is enforced by an automated test on every build. Residual copies in encrypted backups age out within 30 days.

Operational transparency

A public /api/health probe reports liveness. We keep a documented data-retention registry and an incident-response playbook, including the GDPR 72-hour breach-notification obligation.

Questions about data handling? Reach us via the in-app support form. This page is transparency, not a contract; enterprise procurement documents are available on request.