Skip to content
Early access: the full platform is free until general availability.See plans
ExfilPath

Security and privacy

A security platform should not widen your attack surface.

ExfilPath is architected so that analysing an agent is never itself a risk: static analysis, local processing, no credentials, no code retained. This page is written to be handed to a reviewer.
Local analysisNo executionNo code retainedAir-gapped option

Guarantees

What the architecture makes true.

Your code is never executed

Analysis is entirely static. ExfilPath reads source and reasons about it. It does not run your agent, import your modules, evaluate expressions or start a sandbox, so assessing a hostile repository is safe by construction.

Analysis happens where your code already is

Browser analysis runs in your own session and pipeline analysis runs on your runner. Source is processed on infrastructure you already trust with it.

No credentials, no model calls

ExfilPath needs no repository tokens, cloud roles or model provider keys. There is nothing to rotate and nothing to over-scope.

No source code retained

We hold no copies of your source and no scan archive. Reports exist where you save or export them.

Air-gapped operation supported

Enterprise deployments run the same analysis fully inside your network, with no outbound connection required.

Deterministic, reviewable findings

The same input produces the same report, and every detector is documented publicly, so a finding can be reviewed rather than trusted.

Vendor review

The six questions every review asks.

Answered here so a security questionnaire takes minutes rather than a round of emails.
Does customer source code leave our environment?No. Browser analysis is performed in the customer session and pipeline analysis on the customer runner. Enterprise self-hosted deployments have no outbound requirement at all.
What data do you process?For the analysis itself, none on our side. If you contact us or create an account, we process the business contact details you provide.
Is customer code used to train models?No. ExfilPath performs static analysis and does not send code to any model provider.
What access does ExfilPath require in our systems?None. There are no repository tokens, no cloud roles and no agents to deploy.
How is a finding verified?Every path includes its full trace with file and line references, the controls detected on the way, and a confidence score, so your engineers can confirm or dismiss it directly against the code.
What does an empty report mean?That no route was found between the input surfaces and sensitive actions in scope with the current detectors. It is a strong signal, and it is not a proof of overall security — the analysis scope is documented on the platform page.

Need this in your own template, or a signed DPA? support@exfilpath.tech

Programme

Our own security practice.

The same reasoning we apply to your agents, applied to our platform.

Minimal footprint

The analysis engine carries no runtime dependencies beyond Node itself, which keeps the supply chain small and reviewable.

Least data

We do not collect source code, file names or findings. There is no scan archive to breach.

Certification

Formal certification is planned for general availability. Because no customer source is processed on our infrastructure, most control questions are answered by the architecture rather than by policy — the vendor review section above is the current position.

Sub-processors

None participate in analysis. Standard providers serve this website and our business email; the current list is available on request.

Change control

Detector and engine changes ship with tests, and every release is recorded in the public changelog.

Incident response

Security reports route to a named engineer with a three business day acknowledgement target.

Responsible disclosure

Found something in ExfilPath? Tell us directly.

Email support@exfilpath.tech. Please do not open a public issue for a security report.
  1. 01

    Report it

    Email support@exfilpath.tech with the affected surface, the version and a reproduction if you have one.

  2. 02

    Acknowledged within 3 business days

    You get a named contact and an initial assessment.

  3. 03

    Fix timeline agreed

    We target a fix for a confirmed critical issue within 14 days and keep you updated until it ships.

  4. 04

    Credit where wanted

    With your permission we credit you in the changelog. We will not pursue good-faith research that follows this policy.

In scope: the analysis platform, the pipeline integration and this website. Out of scope: findings produced about your own code, and automated scanner output without demonstrated impact.

Running a security review of ExfilPath?

We will complete your questionnaire and join a call with your reviewers.

Start the review