One page instead of promises scattered across the site. Literally what the code does: which fields are written, which are not, and when.
The file is processed in memory and never written to disk. The report isn't stored on the server either: it travels back to you in a signed token in the URL. So there is no way to open someone else's report by guessing a link, and nothing for us to hand over on request — we don't have it.
Exactly these fields, one line per analysis. This list isn't a paraphrase — it comes from the code, and a test keeps the two in sync, otherwise it would go stale on the first field someone adds:
eventtsversionpou_countglobals_countfindingshighmediumlowscoreduration_msrule_countssignalscoverageuser_id
Statistics collection is currently off entirely — not even this is written.
Not a line of code, no POU or variable names, no file name, no project name. The file name used to be logged and was removed in a separate fix: a name like “BTP_4714_SPK107” identifies the site, and the log is shared.
Private mode: nothing is written about the analysis, not even the anonymized aggregate.
Only then does an aggregate reach the database: file name, project name, IDE version, POU and global counts, severity counts, score, per-rule counts and the sha256 of the uploaded file. The fingerprint ties a certificate to one specific build rather than to a project name; it cannot be turned back into content, and it never goes into the shared statistics. That is your own history and only you can see it. Still no code.
Your code is never sent anywhere — not to cloud models, not to external APIs. The analysis is XML parsing and arithmetic on our server. The only external thing on these pages is a visit counter, which never touches file contents. Session recording is deliberately disabled on the tool pages — a report shows your code; you can check that in the page source.
This is a tool, not a corporate compliance programme: we take on no legal obligations about data processing, and everything above describes how the code works, not what is written in signed paperwork. If your security team has requirements, write to us and we'll discuss them concretely — we won't promise anything in advance.