Security & Privacy Policy
Your code is your intellectual property. Here's exactly how we handle it.
🛡️ Our Core Principles
1. Minimal Access
Our GitHub App requests read-only access to code content. We cannot:
- Modify your code
- Create or delete files
- Access other repositories you haven't authorized
- See your private tokens or secrets
2. Temporary Processing
When you trigger an audit:
- Your code is downloaded to a secure, isolated analysis environment
- Analysis tools (Slither, Mythril) run in memory
- Results are extracted and saved to our database
- Source code is immediately deleted (within seconds)
3. Zero Data Retention
We DO store:
- Audit results (vulnerabilities found, severity, line numbers)
- Gas optimization suggestions
- Audit metadata (timestamp, repository name, commit SHA)
We DO NOT store:
- Your source code
- Environment variables or secrets
- Dependencies or full project structure
🏗️ Technical Architecture
Data Flow Diagram:
Code retention time: 1 to 10 minutes
Your source code exists in memory only during analysis and is immediately purged. Zero permanent storage.
📊 See Real Results
Don't take our word for it. Check out actual audit reports showing vulnerabilities found and gas optimizations suggested.
View Showcase Reports →📋 Compliance
Smart Contract Audit Standard
We follow best practices from established Web3 security firms like Trail of Bits and OpenZeppelin: read-only access, zero code storage, and immediate deletion after analysis.
Zero Code Storage & User Control
Your code is never permanently stored. You can request deletion anytime, revoke access instantly, and maintain full control over your intellectual property globally.
🏢 Enterprise Self-Hosted Option
For organizations with strict data residency requirements, we offer a self-hosted deployment where:
- All analysis happens on your infrastructure
- Zero data leaves your network
- Full control over data retention policies
- Dedicated support and custom integrations
📊 How We Compare
Solidity Prism is a comprehensive pre-audit tool for developers: security vulnerabilities + gas optimization analysis in one platform. Designed for continuous development workflow and rapid iteration—not as a replacement for professional audits, but as an essential step before them.
| Security Practice | Solidity Prism | Industry Standard |
|---|---|---|
| Code Access Type | ✅ Read-only | ✅ Read-only |
| Source Code Storage | ✅ Zero (deleted immediately) | ⚠️ Variable (some tools cache) |
| User Control | ✅ Revocable anytime | ✅ Revocable anytime |
| Third-Party Sharing | ✅ Never | ✅ Never (reputable tools) |
| Self-Hosted Option | ✅ Available (Enterprise) | ⚠️ Rare |
Important Disclaimer: Solidity Prism is a powerful pre-audit and continuous development tool, not a substitute for professional security audits. The results are intended to help you catch common issues and optimize gas costs quickly during development, but Solidity Prism cannot be held responsible for any bugs, vulnerabilities, or errors introduced or missed as a result of following suggestions.
Our engine leverages industry-leading tools like Slither and Mythril, and uses advanced AI-driven formatting for clarity and actionable advice. However, all automated analysis tools can overlook very complex or novel vulnerabilities, and although our AI layer is designed for maximal precision, it may very rarely hallucinate or misinterpret findings (we've minimized this through extensive prompt engineering and validation).
Always perform your own code review and engage professional auditors before mainnet deployment. Solidity Prism is an assistant, not a replacement for human expertise or final responsibility.
❓ Security FAQ
What if Solidity Prism is hacked?
Since we don't store source code, there's nothing for attackers to steal. Our database contains only audit results (publicly visible findings like "reentrancy vulnerability on line 42"). Your intellectual property is never at risk.
Do you use my code to train AI models?
No. Your code is never used for training, fine-tuning, or any machine learning purposes. Analysis is purely rule-based and symbolic execution.
How do I revoke access?
Solidity Prism runs as a GitHub Action in your repository. To revoke access:
- Delete the workflow file: In your repository, delete
.github/workflows/solidity_prism.ymland commit the change. This immediately stops all audits. - Remove the secret (optional): Go to your repository Settings → Secrets and variables → Actions, find
PRISM_ACTION_SECRET, and click Remove. - Deactivate in dashboard (optional): Log in to your Solidity Prism dashboard and deactivate the repository.
See our full uninstallation guide for detailed instructions.
Still Have Questions?
We're happy to discuss our security practices in detail.
Open an Issue on GitHub