A scanner can run on a developer machine, inside your own pipeline, or in the vendor's cloud. Each places your source code, results and metadata in a different spot. Before a pilot, ask the vendor to draw the data flow and say, for each data type, where it is processed, stored and deleted.
Three common run locations
| Where it runs | Code leaves your network? | Typical trade-off |
|---|---|---|
| Local, on a laptop or build server | Usually no, but results may be sent to a console | Easiest to control, more to manage |
| In your pipeline | Depends on whether results are uploaded | Fits existing workflow |
| In the vendor cloud | Yes, at least some data | Least setup, most data to review |
Many tools mix these. A local scan may upload only results. Ask which parts go where.
Five data types to trace
- Source code. Is any of it uploaded, in full or in fragments?
- Dependency lists. Names and versions are often needed for matching.
- Findings and results. Where are they stored, and who can see them?
- Account and usage data. Who signs in, and what activity is recorded?
- Logs and error reports. Could they contain code snippets or paths?
The ten questions
- Show me the data flow diagram for a standard scan.
- What is uploaded, field by field?
- What stays on our side?
- Where are uploaded data stored, by country or region?
- Who at the vendor can access our data, and how is that logged?
- How long is data kept?
- How do we delete it, and how do you confirm?
- Which subprocessors touch it?
- Can we run it with no upload at all, and what do we lose?
- What changes in the diagram when we turn on features such as automated fixes?
Write the answers down. Attach the diagram to the purchase record. If the diagram changes with a product update, ask for notice.
Public sector twists
Some public bodies have rules on where data may be stored, who may access it, or whether it may leave the country. Ask your procurement and legal teams before the pilot, since the vendor cannot answer that for you. See data residency FAQ.
Pilot design that limits exposure
- Start with a non-sensitive repository.
- Remove test data containing personal details first.
- Use a service account with read only access, and revoke it after the pilot.
- Record what the tool sent, using proxy logs if your network allows.
Seeing actual traffic beats reading a policy page. See also least privilege for a scanner pilot.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what the result contains: file paths and line references show what a result can reveal about your code.
Safeguard also offers a free scan at gold.safeguard.sh/scan, and its Desktop app and CLI are listed on the download page.
Quick check
Is a local scan always private?
Not always. Ask whether results, usage data or error reports are sent to a console.
What is the best evidence of what a tool sends?
Network logs from a pilot, compared against the vendor's written data flow.
Last reviewed: 19 October 2026.
