Sometimes, and it depends on the architecture. Some scanners run entirely on your machines and send nothing. Some send manifests or metadata. Some upload source to a hosted service. You cannot tell from the product category, so ask for a data flow, in writing, before the pilot starts.
The three common models
| Model | What leaves your environment | Typical fit |
|---|---|---|
| Local scan, no upload | Nothing, or only licence and usage data | Strict data rules, air gapped teams |
| Metadata or manifest upload | Package names, versions, file hashes, finding summaries | Dependency and SBOM scanning |
| Source upload to hosted service | Source files or diffs | Hosted static analysis, AI review |
Dependency scanning is usually in the middle group, because a lockfile lists packages rather than your logic. Code analysis is more likely to need file contents, though many tools can run it locally.
What to ask, in order
- Which files or fields are read for each scan type?
- Which of those are transmitted, and where is the processing region?
- Is anything stored after the scan finishes, and for how long?
- Who at the vendor, and which subprocessors, can access stored data?
- Can customers choose a deployment where code stays local?
- Is any customer data used to train or tune a model?
Ask for the answers as a data flow diagram, not a paragraph. A diagram forces specifics: arrows, storage boxes, regions.
Test it yourself
Do not rely only on the answer. During the pilot, run the scanner on a test repo from a machine where you can watch outbound connections. Compare destinations with the vendor's subprocessor list and document what you see. This takes an afternoon and settles many arguments.
Plant a harmless marker string in a test file, then ask whether that string appears anywhere in the vendor's console, logs or support exports. If it does, the file contents travelled.
Write it into the contract
The data flow you accepted should match the data processing terms. If the diagram says manifests only, the agreement should say so, and any change that adds source upload should require notice. See do you need a DPA for a code scanner for the paperwork side.
Try it yourself
The dependency inventory demo shows what a software composition scan reads and reports. Notice how much comes from package metadata rather than your own source files.
Click through it at your own pace, or open it full screen.
Safeguard provides SBOM and dependency scanning, and you can try a free scan at gold.safeguard.sh/scan.
Quick check
Is a lockfile sensitive?
It reveals which components and versions you run, which can help an attacker choose exploits, but it does not contain your application logic. Treat it as confidential business data.
Does a SaaS scanner always upload code?
No. Many SaaS products analyse metadata or run analysis in your CI runner and send only results. Confirm with a data flow diagram.
Last reviewed: 19 October 2026.
