Working document - legal review pending before any paid launch.
PatchLedger stores: your account email, a salted scrypt hash of your password, your agency profile (name, branding color, contact email), your projects, and the scanner JSON you choose to paste (package names, versions, advisory identifiers). We never ask for repository access, tokens, or your source code, and the product sends nothing to third-party AI services - parsing and reporting are deterministic.
Data flow: pasted scanner output is parsed server-side, reduced to advisory-level findings, and stored against your account. Shared report links contain an unguessable random id, are marked noindex, and can be revoked at any time (a revoked link returns 404).
Retention and deletion: everything is kept until you delete it. Deleting your account (Account page, type DELETE) removes your projects, findings, snapshots, reports, sessions and audit rows in one operation. There is no backup beyond the operational database snapshot regime documented in SECURITY.md.
Logs: authentication and import actions are recorded in an internal audit trail visible to you on the Account page. Audit entries store labels and counts only - never raw scanner payloads.
Contact: reply to the email you signed up with, or the address on your report footer.