Security

How we protect your code and data

Last updated: July 15, 2026

Our Security Commitment

At DeadCode.io, security isn't an afterthought—it's foundational. We understand that you're trusting us with access to your source code, and we take that responsibility seriously. Our security practices are designed to meet the needs of enterprise engineering teams.

Security Certifications & Compliance

SOC 2 Type II GDPR Compliant ISO 27001 CCPA Compliant

Infrastructure Security

Hosting & Network

Cloud Infrastructure: Hosted on enterprise-grade cloud providers (Cloudflare, AWS) with 99.99% uptime SLA
Edge Network: All traffic routes through Cloudflare's global edge network with DDoS protection
TLS Encryption: All data in transit is encrypted using TLS 1.3
Network Isolation: Production environments are isolated with strict firewall rules

Data Encryption

Data State	Encryption Method
In Transit	TLS 1.3 (AES-256-GCM)
At Rest	AES-256 encryption
Backups	AES-256 with separate key management
Secrets/Tokens	Vault-based encryption with key rotation

Application Security

Authentication & Access Control

OAuth 2.0: Secure authentication via GitHub OAuth—we never store your GitHub password
Minimal Permissions: We request only read-access to repositories, never write access
Role-Based Access Control: Fine-grained permissions (Owner, Admin, Developer, Viewer)
Session Management: Secure session tokens with automatic expiration
SSO Support: Enterprise SSO via SAML 2.0 for centralized identity management

Code Handling

Your code is treated as highly sensitive data:

Temporary Processing: Code is analyzed in ephemeral containers that are destroyed after each scan
No Code Storage: We store scan results (metadata only), not your actual source code
Isolated Environments: Each scan runs in its own isolated container with no network access to other environments
On-Premise Option: Enterprise customers can run scans entirely on their own infrastructure

What We Store vs. What We Don't

We Store	We Don't Store
Scan results (file paths, line numbers)	Your actual source code
Repository metadata (name, branch)	File contents
Dead code metrics (counts, types)	GitHub access tokens (encrypted at rest)
Audit logs of actions	Credentials or secrets from your code

Security Practices

Development & Deployment

Secure SDLC: Security review at every stage of development
Code Review: All changes require peer review before deployment
Dependency Scanning: Automated scanning for vulnerable dependencies
Penetration Testing: Annual third-party penetration tests
Bug Bounty: Responsible disclosure program for security researchers

Monitoring & Incident Response

24/7 Monitoring: Real-time alerting for security anomalies
Audit Logs: Comprehensive logging of all system and user actions
Incident Response: Documented procedures with <4 hour response time
Breach Notification: We notify affected customers within 72 hours of confirmed breach

Enterprise Security Features

Enterprise plans include additional security controls:

SAML SSO: Integrate with Okta, Azure AD, OneLogin, or any SAML 2.0 provider
IP Allowlisting: Restrict access to specific IP ranges
Custom Data Retention: Configure how long scan data is retained
Dedicated Infrastructure: Isolated compute resources for your organization
Security Questionnaire: We provide completed SIG, CAIQ, and custom questionnaires
DPA/BAA: Custom data processing agreements available

Vulnerability Disclosure

If you discover a security vulnerability, please report it responsibly:

Email: security@marketingstudios.in
Please include detailed steps to reproduce
We aim to acknowledge reports within 24 hours
We do not pursue legal action against good-faith security researchers

Questions?

For security-related inquiries or to request our SOC 2 report, contact us at security@marketingstudios.in or reach out to your account manager.