Your code deserves
a clear boundary.
What a scan stores
Shipvra stores the submitted public URL, scan timestamps, rule outcomes, sanitized findings, and purchase records. Raw response bodies and cookie values are not retained as scan evidence.
A private browser session controls access to scans, purchased reports and connected repository results. The session cookie is HttpOnly, uses SameSite=Lax and is restricted to HTTPS in production. It expires after 90 days. Session credentials are stored as hashes.
Repository access
When you connect GitHub, your access token is encrypted at rest. Deep Inspect reads bounded source files at a recorded commit and retains sanitized findings. It does not execute repository code.
Disconnecting removes the stored GitHub token. You can also revoke the app in GitHub settings. Purchase processing is handled by Stripe; Shipvra does not store card details.
Workspace recovery
You can create a recovery code from your workspace. The code is shown once, and only its hash is stored. Keep the code in a password manager: anyone holding it can restore access to your workspace.
Restoring a workspace consumes the code, issues a new one and signs out previous device sessions. Creating a replacement code invalidates the previous code. Without a saved recovery code, clearing or losing your session can make the workspace inaccessible.
Export your evidence
Workspace export provides structured JSON containing your scans, findings, source results, repair records, verification records and order summaries. It excludes session and recovery credentials, GitHub access tokens and internal signing secrets.
Exports have record and payload limits. The downloaded file states those limits and marks categories where records were omitted. Evidence is sanitized again before export.
Erase your workspace
Workspace deletion removes scan evidence, source inspection and repair records, verification records, repository credentials, recovery codes and sessions. Application URLs and ownership are removed from retained scan references. Queued work is cancelled; requests already sent to external services may still complete.
Deletion is permanent. It does not delete branches or pull requests already created in GitHub, revoke the GitHub App installation, or remove copies of reports and exports you downloaded.
Financial records and limits
Order and payment records are retained for accounting, refunds and dispute handling after workspace deletion. Retained references no longer contain workspace ownership or application URLs. Payment processors maintain their own records under their policies.
Workspace evidence remains available until it is erased. This page does not promise an automatic retention deadline or that erasing a workspace deletes records held by external providers.