Data processing agreement

In force from 1 November 2026.

We do not write our own data-processing terms. We use the Danish Data Protection Agency's (Datatilsynet's) standard contractual clauses, adopted under Article 28(8) GDPR after an opinion from the European Data Protection Board, last amended 4 March 2024. The clauses are unmodified.

What is specific to us is in the annexes below. For a countersigned copy, write to info@canine.dev.

The processor is Canine Development ApS, CVR 42092134, Vestervej 26, 8500 Grenaa, Denmark. The agreement covers Assert, Canine Code Analyzer (CCA) and Assay, and Assure when a business uses it.

We measure your codebases against an open, published standard (the Code Assurance Index) and return the result as scores, findings, reports, metrics and trends. Personal data is processed only because (a) the service needs an account, and (b) source code and git history identify the people who wrote them. We do not process the data for our own purposes, and we do not train models on your code.

Temporary cloning of the connected repository, analysis by fixed rules, generation and storage of reports and metrics, and disposal of the working copy. The plain-language text in reports may be written by software, including a language model, hosted on our own hardware; it takes no part in the measurement. The processing is read-only: we never write to your repository, open no pull requests and change nothing in your source system.

• Account data. The sign-in identity from the service you sign in with: login, display name, email address.
• Repository data. Source code, and git metadata: commit authors' names and email addresses, timestamps and change history.
• Derived data. Reports, metrics and findings, which may quote short code excerpts and reflect git authorship. For Assert, a pseudonymous key per commit author and whether the author is a human, an agent or a bot, used only to count the authors a month is charged for; it is never published and never shown with a name.

We do not knowingly process data covered by Article 9 or 10. Source code may contain personal data that you have put there; what the repository holds is yours to decide.

• Your users of the service (account holders).
• Anyone appearing as an author in a connected repository's git history, including former employees and outside contributors.

Processing runs from the moment you connect a repository until your account is closed, after the reversible period in C.4.

Stripe Payments Europe, Limited (Ireland), for payment processing. Card data never reaches our servers.

That is the whole list. Sign-in, the analysis engine, any software that writes report text, email, the database and report storage all run on hardware we own in Denmark. No analytics service, no error-tracking service, no CDN, no cloud AI.

Your code host (GitHub, GitLab, Bitbucket, Azure DevOps) is not our sub-processor. You hold your own agreement with it, and connecting a repository gives us read access to material you already placed there.

We update this page and email the account's owners before a new sub-processor begins processing, so you have time to object.

We may only: read the connected repository's default branch and your account identity at your code host; clone the source into volatile memory and analyse it there; generate and store reports, metrics and findings derived from that analysis; and dispose of the working copy under C.4. Connecting a repository, choosing a cadence, requesting a scan (in the product, over the API or MCP with your key) and making a key for an agent are your documented instructions.

• Source code is cloned only into RAM and deleted when the scan finishes, whether it completed, failed or was cancelled; a recurring sweep removes anything a crashed run left behind.
• Database storage and report artefacts are encrypted at rest (LUKS2, AES-256-XTS).
• All processing and storage runs on hardware we own and operate in Denmark. There is no cloud provider in the data path.
• No outside AI. Any language model used is self-hosted, and no code is sent to OpenAI, Anthropic, Google or any other AI provider.
• Access is read-only. Report access mirrors your access at your code host and is re-synchronised daily.
• Analysis runs in a hardened container with no or controlled network access.

We assist with data-subject requests. We notify you without undue delay of a personal-data breach, under clause 9 of the standard clauses.

• Source code, connected repository: in RAM only, deleted when the scan that needed it finishes; nothing survives a restart of the host.
• Source code, uploaded archive: in RAM only, removed after seven days without use, and gone on a restart.
• Reports and metrics: kept while the account is open, also after a repository is disconnected, so its history is still there if it is connected again.
• Account data: you can close the account yourself; after a 14-day reversible period it is deleted.
• Invoices: kept where bookkeeping law requires.

All processing and storage takes place on our own hardware in Denmark. We transfer no personal data to third countries. Our payment counterparty is Stripe Payments Europe, Limited, in Ireland; where Stripe transfers data to its US group company, it does so under its own data-processing agreement, with the European Commission's standard contractual clauses and the EU-US Data Privacy Framework.

No separate terms beyond the standard clauses and annexes A to C.