What Assure collects, what leaves your runner, what the server keeps and for how long, and what it never reads, is stated in one document the product ships with: [Your data](/docs/data). That page is rendered from the Assure repository and is the source of truth; this page only points to it.

In brief, as that document states it:

- The Action collects in your runner and sends only the files the profile reads, each within its limit.
- Secrets, comments in configuration files and string literals in policy expressions are withheld before anything is sent.
- The server deletes the collected facts when the check ends and keeps the verdict for 30 days.
- The readable report and the requirements upload are opt-in.
- Your data is used to improve the product only when you opt in.

See also [Privacy](/legal/privacy) and the [Terms](/legal/terms).