Question 1

What counts as a connected cloud account or repository?

Accepted Answer

An AWS account you’ve installed our read-only audit role into, and a repository the GitHub App is installed on. That’s the whole axis — we don’t count your developers, your seats, or your findings.

Question 2

What happens when I hit a limit?

Accepted Answer

Everything you have already connected keeps being scanned on schedule, and you are never invoiced for overage. What we do is decline the new thing: connecting an account or repository past your plan’s estate limit is refused with an upgrade prompt, and pressing scan again inside your tier’s cadence window is declined with the time it clears. Nothing is silently dropped or half-done.

Question 3

Where does my scan data live, and what access do you have?

Accepted Answer

Scan results live in our platform, scoped to your workspace. Cloud access is a read-only audit role you can revoke at any time — we never hold write access to your cloud.

Question 4

Do you get write access to my repositories?

Accepted Answer

Yes — the minimum opening a pull request takes, and we would rather say so than let the install screen correct us. The GitHub App holds write on code and pull requests, because a draft PR means pushing a branch. It writes only to its own autosec/finding-* branch, never to yours: it cannot push to your default branch and it cannot merge anything. The draft flag is a hardcoded literal on the one call that opens a PR, and no merge call exists anywhere in the product. Uninstall the App and the access is gone with it.

Question 5

How are AI runs metered?

Accepted Answer

A run is one agent working one finding — a triage, a root-cause pass, a fix draft. Your workspace shows the meter. At the ceiling we decline new runs until the month rolls or you upgrade; we do not queue them and we do not bill overage. Scanning is unaffected — the meter is on the AI, not on the security service.

Question 6

Are you SOC 2 certified?

Accepted Answer

Not yet. We won’t print a badge we don’t hold. Our /security page lists the verifiable controls we run instead — read-only cloud roles, network-isolated scan jobs, draft-only remediation — and names the gaps honestly.

Question 7

What does the Dedicated tier actually dedicate?

Accepted Answer

Your own database. On Free and Pro, isolation is enforced in the application; on Dedicated, your workspace’s data lives in a database that is yours alone.