Security & Compliance
Your data, our posture
EnvLens processes the inputs you submit for analysis. This page states, plainly, what we handle and what we do not claim.
What we handle
You paste config text. Hints stay on that text. EnvLens does not open a repository or rotate keys. Prefer a redacted sample.
Data handling commitments
- Submissions run the product pipeline and are retained only as long as needed for your saved history (paid tiers) or until you delete the run.
- We apply access controls consistent with GDPR Art. 32 (security of processing) where personal data is processed.
- BYOK keys (Enterprise), when offered, are stored server-side only and never exposed to the browser.
Honesty rule: EnvLens helps find likely leaked secrets and bad settings. We do not guarantee finding every secret, 100% config safety, or that you will never miss a leak. Do not paste production secrets into untrusted tools. We do not claim guarantee / 100% / never miss. EnvLens is not a penetration-test certification.
Our compliance posture
- EnvLens is decision-support for configuration review — not a law firm, clinic, certified auditor, or penetration-test lab.
- A clean scan is evidence that these checks found nothing in the pasted text; it is not a substitute for a scoped assessment.
- For binding advice, consult a qualified security professional in the relevant domain.
Subprocessors & payments
refs: OWASP Secrets Management Cheat Sheet · CWE-798 Use of Hard-coded Credentials · OWASP Top 10 A07 Identification and Authentication Failures