Data handling

What Assure collects, what leaves your runner, what the server keeps and for how long, and what it never reads, is stated in one document the product ships with: Your data. That page is rendered from the Assure repository and is the source of truth; this page only points to it.

In brief, as that document states it:

• The Action collects in your runner and sends only the files the profile reads, each within its limit.
• Secrets, comments in configuration files and string literals in policy expressions are withheld before anything is sent.
• The server deletes the collected facts when the check ends and keeps the verdict for 30 days.
• The readable report and the requirements upload are opt-in.
• Your data is used to improve the product only when you opt in.

See also Privacy and the Terms.