How we handle your data

overview this document provides a high level summary of how our scanner handles credentials found in your environment key security principles how we handle credentials found by your scanner is built on these core principles never store raw credentials we only store cryptographic fingerprints and metadata volatile memory only raw credentials exist only in ram during processing immediate verification credentials are verified using safe, read only api calls automatic cleanup go's garbage collector ensures memory is cleaned up complete isolation each customer has isolated instances and databases how it works the following lays out what happens inside the trufflehog enterprise scanner 1\ discovery when our scanner finds a potential credential, it identifies the credential type (aws, github, azure, etc ) extracts the credential data prepares for verification 2\ verification we immediately verify the credential by making a safe, read only api call to the service provider testing if the credential is valid without modifying any resources using appropriate endpoints for each service (e g , aws sts, github api) 3\ analysis for many verified credentials, we can perform additional analysis discover what resources and permissions the credential has access to assess the potential impact and scope of the credential identify the creator of the credential all using safe api calls for all analysis operations 4\ storage we store only cryptographic fingerprints redacted portions (e g , "sk live 1234 ") metadata about where it was found and attributes about the credential see data flow docid\ loqejrunrsxddrie5bzgu for more information on what information is transmitted 5\ cleanup after processing raw credentials are no longer referenced go's garbage collector automatically reclaims memory there is never persistent storage of raw credentials deployment models on premises scanner completely local processing all scanning happens in your infrastructure secure cloud environment with customer isolation, and encryption in transport and in storage only metadata sent to cloud never raw credentials comprehensive security controls and audit logging cloud scanner isolated processing instances per customer secure cloud environment with customer isolation, and encryption in transport and in storage only metadata sent to cloud never raw credentials comprehensive security controls and audit logging security measures data protection tls encryption for our api communications mtls encryption for database connections database encryption for stored metadata strict access controls and audit logging year round soc 2 type ii auditing and gdpr compliance verification safety read only api calls only no state changing operations memory security secure memory allocation practices process isolation per customer automatic memory cleanup what we don't do ❌ store raw credentials found in any persistent storage ❌ log raw credentials in any log files ❌ share credential data between customers ❌ make state changing api calls during verification summary finding leaked credentials is safe with us our architecture is designed with security as a primary consideration, ensuring that only metadata, redacted versions, and cryptographic fingerprints are stored by us verification uses safe, read only operations memory is automatically cleaned up complete customer isolation is maintained we understand the sensitivity of credential data and have built multiple layers of protection to ensure your credentials are handled safely and securely if you'd like to dive in a bit deeper, see our data flow docid\ loqejrunrsxddrie5bzgu documentation