Here's a conversation we have a lot with banks and other regulated teams. They like the scanner. They like the findings. Then someone from risk asks one question: where does our source code go?
If the honest answer is "to the vendor's cloud," the evaluation is often over.
You can now run Safeguard's scans so that the answer is "nowhere." Your code stays on infrastructure you control. Only results leave.
Three ways to keep code in place
1. SAST on your own runners. Safeguard's SAST scans can run on on-premises runners that you manage. The runner pulls the code inside your network, scans it there, and reports findings.
2. A headless runner image. For build farms and locked-down hosts where nobody is going to click through a setup, there's a headless runner image built for non-interactive environments.
3. Local CI scanning. In GitHub Actions, GitLab CI or Bitbucket Pipelines, the scan runs locally on the CI runner and uploads only the results. It authenticates with a secret key, so you don't need to connect a source code integration at all.
What leaves your environment
Findings. Which package, which version, which vulnerability, where in the code. Not the code.
When the whole platform has to stay inside
Some teams need more than local scanning. Safeguard also deploys in a private VPC or dedicated tenancy, fully on-premises, or fully air-gapped, including the AI models running inside your environment with signed offline updates.
Getting started
Setup guides for runners and CI scanning are in the docs at docs.safeguard.sh. If your security review has a checklist for this, send it over and we'll go through it with you.
Try it yourself
Click through it at your own pace, or open it full screen.
Pick one repository that your risk team would never let leave the network. Write down what a scanner would need to send out to give you findings for it. Then compare that list with what the local runner sends: findings only. The gap between the two lists is your security review's answer. Also worth a look: scanning from your CI/CD pipeline.
Quick check
With local CI scanning, what leaves your environment?
The findings: which package, version and vulnerability, and where in the code. Not the source code itself.
Do you need to connect a source code integration for local CI scanning?
No. The scan runs on the CI runner and authenticates with a secret key.
