Security and privacy
A security platform should not widen your attack surface.
Guarantees
What the architecture makes true.
Your code is never executed
Analysis is entirely static. ExfilPath reads source and reasons about it. It does not run your agent, import your modules, evaluate expressions or start a sandbox, so assessing a hostile repository is safe by construction.
Analysis happens where your code already is
Browser analysis runs in your own session and pipeline analysis runs on your runner. Source is processed on infrastructure you already trust with it.
No credentials, no model calls
ExfilPath needs no repository tokens, cloud roles or model provider keys. There is nothing to rotate and nothing to over-scope.
No source code retained
We hold no copies of your source and no scan archive. Reports exist where you save or export them.
Air-gapped operation supported
Enterprise deployments run the same analysis fully inside your network, with no outbound connection required.
Deterministic, reviewable findings
The same input produces the same report, and every detector is documented publicly, so a finding can be reviewed rather than trusted.
Vendor review
The six questions every review asks.
| Does customer source code leave our environment? | No. Browser analysis is performed in the customer session and pipeline analysis on the customer runner. Enterprise self-hosted deployments have no outbound requirement at all. |
|---|---|
| What data do you process? | For the analysis itself, none on our side. If you contact us or create an account, we process the business contact details you provide. |
| Is customer code used to train models? | No. ExfilPath performs static analysis and does not send code to any model provider. |
| What access does ExfilPath require in our systems? | None. There are no repository tokens, no cloud roles and no agents to deploy. |
| How is a finding verified? | Every path includes its full trace with file and line references, the controls detected on the way, and a confidence score, so your engineers can confirm or dismiss it directly against the code. |
| What does an empty report mean? | That no route was found between the input surfaces and sensitive actions in scope with the current detectors. It is a strong signal, and it is not a proof of overall security — the analysis scope is documented on the platform page. |
Need this in your own template, or a signed DPA? support@exfilpath.tech
Programme
Our own security practice.
Minimal footprint
The analysis engine carries no runtime dependencies beyond Node itself, which keeps the supply chain small and reviewable.
Least data
We do not collect source code, file names or findings. There is no scan archive to breach.
Certification
Formal certification is planned for general availability. Because no customer source is processed on our infrastructure, most control questions are answered by the architecture rather than by policy — the vendor review section above is the current position.
Sub-processors
None participate in analysis. Standard providers serve this website and our business email; the current list is available on request.
Change control
Detector and engine changes ship with tests, and every release is recorded in the public changelog.
Incident response
Security reports route to a named engineer with a three business day acknowledgement target.
Responsible disclosure
Found something in ExfilPath? Tell us directly.
- 01
Report it
Email support@exfilpath.tech with the affected surface, the version and a reproduction if you have one.
- 02
Acknowledged within 3 business days
You get a named contact and an initial assessment.
- 03
Fix timeline agreed
We target a fix for a confirmed critical issue within 14 days and keep you updated until it ships.
- 04
Credit where wanted
With your permission we credit you in the changelog. We will not pursue good-faith research that follows this policy.
In scope: the analysis platform, the pipeline integration and this website. Out of scope: findings produced about your own code, and automated scanner output without demonstrated impact.
Running a security review of ExfilPath?
We will complete your questionnaire and join a call with your reviewers.