Security
Uncompromising security for high-stakes diligence.
We built CodeDD to secure the transaction. Our ephemeral architecture ensures that intellectual property is analyzed deeply but never retained.
For target companies
Zero-Retention Guarantee.
Your intellectual property is your most valuable asset. We do not store your source code. CodeDD uses a volatile memory architecture where repositories are streamed, analyzed in isolation, and immediately wiped upon report generation.
- No permanent storage of source code.
- Ephemeral, sandboxed analysis environments.
- Exclusion of proprietary business logic from model training.
For investors & advisors
Institutional Data Governance.
Conduct diligence without the liability of data custody. The platform provides the audit trail and scalability required by investment committees, secured by enterprise-grade encryption and strict access controls.
- ISO 27001 & SOC 2 aligned controls.
- End-to-end encryption (TLS 1.3 & AES-256).
- Role-based access control (RBAC) for deal teams.
- Data residency in Europe (IONOS).
Enterprise-Grade Protection.
Our infrastructure is designed to withstand the rigorous demands of institutional finance and enterprise technology.
Infrastructure Isolation
CodeDD runs on single-tenant containerized instances. Each audit occurs in a fresh, isolated environment that shares no state with other clients or analyses.
Encryption Standards
Data is encrypted in transit via TLS 1.3 and at rest using AES-256. API keys and repository credentials are managed via strictly governed vault services.
AI Model Privacy
Our analysis models are frozen. We do not use client code submitted for diligence to train, fine-tune, or improve our base foundation models.
Access Governance
Strict identity management integration allows deal teams to manage granular permissions. Support personnel have zero standing access to client data.
Vulnerability Management
We subject our own platform to the same rigour we apply to yours. Continuous automated scanning and third-party penetration testing ensure platform resilience.
Data Residency
For sensitive cross-border M&A, CodeDD offers region-locked processing to help meet GDPR, CCPA, and local data sovereignty requirements.
Compliant with industry standards and regulations.
Visit the Trust Center →
Independent penetration testing
External security validation of the CodeDD platform.
Most recent engagement
September 2026
FAQ
Security FAQ for CTOs.
Do you clone our repository?
We perform a shallow, ephemeral clone into a cached environment. All source-code files are encrypted using AES-256. Once the analysis is complete (1–2 hours), the cache is permanently deleted.
How does the AI interact with our code?
We use enterprise-grade LLM APIs with zero-retention policies. Your code segments are tokenized, analyzed for patterns (scalability, security, debt), and discarded. The AI does not "learn" from your proprietary algorithms.
What access do I need to grant?
We require read-only access. You can grant this via a specific service account or OAuth token. You remain in control and can revoke access immediately after the scan is initiated.
Is the report confidential?
Yes. The generated Executive Report is accessible only to authorized members of the deal team designated by the paying client.
One platform for technology diligence and monitoring.
Secure and fast setup, with results delivered in hours.