Your Code is Your IP. We Just Do the Math.
How Echeo analyzes code health without exposing your source code.
We understand that connecting a private repository to a third-party tool requires immense trust. We built Echeo's architecture to be privacy-preserving by default. We analyze code health metrics, not your trade secrets.
Here is exactly how our code health analysis engine works, what we store, and—more importantly—what we don't.
1. The "Zero-Training" Guarantee
We do NOT use your code to train Generative AI models.
Your private code is never fed into a training set for OpenAI, Anthropic, or our own internal LLMs. We use pre-trained models solely to generate embeddings (mathematical representations) of your code snippets. Your IP remains yours; it will never appear in someone else's autocomplete suggestion.
2. Metadata Analysis, Not Source Code
When you connect a repository, Echeo performs a Read-Only, Ephemeral Analysis.
- Extraction: We analyze code structure (ASTs) to identify complexity, patterns, and technical debt indicators.
- Analysis: We calculate code health metrics—complexity, test coverage, documentation quality, code churn—without storing source code.
- Discard: We discard the raw source code immediately after analysis.
We store the Metrics, not the Code.
- The Analysis: We measure code complexity, test coverage, documentation quality, and churn patterns. These metrics tell us about code health, but they cannot be reverse-engineered to reconstruct your proprietary business logic.
- The Result: Our database contains code health metrics and predictions, not a backup of your repo.
3. Granular Access Control
- Least Privilege: Our GitHub App requests the minimum permissions necessary (Read-Only for Metadata and Code).
- Private is Private: Private repositories are strictly siloed. Code health analysis from private repositories is only visible to you.
- Example: If you have a proprietary algorithm in a private repo, Echeo analyzes its complexity and code health metrics. These metrics help predict maintenance costs and failure risk, but the actual algorithm code never leaves your repository.
4. Data Retention & Deletion
You Own the Kill Switch: If you disconnect a repository or delete your account, we delete all associated metrics and audit data. Because we don't use your code for model training, there is no "unlearning" process required—we simply delete the database rows, and your data is gone forever.
Technical FAQ
Q: If I push a secret API key by accident, will Echeo store it?
A: No. Our analysis process focuses on code structure and metrics (complexity, patterns, churn). We don't analyze string literals or config files in detail. Furthermore, since we don't store the raw source code, we aren't creating a permanent record of your secrets.
Q: Can anyone see my private code?
A: Never. Your private code is never exposed. We only store code health metrics and predictions. Audit reports show code health scores and risk predictions, but never the actual source code. Only you can see the detailed analysis of your private repositories.
Q: Do you cache my code?
A: We use ephemeral processing memory only. Once the analysis is complete (usually seconds), the raw code is flushed from RAM. We do not persist source code files in our database or object storage. Only metrics and predictions are stored.
The "Bottom Line" for CTOs
If you are a CTO wondering if your team can use Echeo:
- Security & Privacy: We are built with data minimization principles and follow industry security best practices (we don't store what we don't need).
- Isolation: Code health metrics are logically separated by repository and user.
- Value: We help you understand code health, predict failures, and quantify technical debt without exposing your source code or IP.
Payment Security
PCI-DSS Level 1 Compliant
All payments are processed through Stripe, a PCI-DSS Level 1 certified payment processor. This is the highest level of certification in the payment industry.
- We never see your card details - Stripe handles all payment information
- End-to-end encryption - All payment data encrypted in transit and at rest
- Tokenization - Your card details are replaced with secure tokens
- Fraud protection - Stripe Radar detects and prevents fraudulent transactions
Learn more: Stripe Security Documentation
Compliance & Certifications
PCI-DSS Level 1
Compliant via Stripe. Highest level of payment security certification.
GDPR Compliant
Full compliance with European data protection regulations.
CCPA Compliant
Full compliance with California Consumer Privacy Act.
Questions? Contact us at security@echeo.io