Code Security Posture

Executive Summary

Keygraph does not retain full copies of customer source code after analysis completes. Only the specific fragments required to render findings, deduplicate results, and propose remediations are persisted, and all code-derived state, including any descriptive references to code, is encrypted at rest. This document specifies the architectural and operational controls that enforce this posture across our cloud and self-hosted deployment models, and is intended to support vendor security assessments and third-party risk reviews.

Core Principle: Ephemeral Compute, Encrypted Persistence

Several analysis jobs that widen the whitebox pentest's scope (SAST, secrets detection, SCA) require read access to source code. The platform executes these jobs in short-lived, isolated, single-use environments backed by encrypted storage:

• Each repository is cloned into a fresh, ephemeral container dedicated to that scan job.
• Containers share no state with other tenants and are not reused across scan runs.
• The working copy of the cloned repository lives only in the container's ephemeral filesystem and is destroyed when the container is terminated.
• During the scan, the container has scoped write access to a tenant-isolated, encrypted-at-rest S3 bucket where intermediate artifacts are persisted. The full source tree is not written to this bucket.
• After analysis completes, the container is terminated and its ephemeral storage is wiped.

Persisted state after a scan consists of structured findings (issue metadata: location, severity, rule ID, fingerprint), a small number of intermediate analysis artifacts required to render and triage findings, and the code snippets explicitly described in the Code Retention section below. All such state is encrypted at rest.

Integration Permissions

Keygraph integrations follow the principle of least privilege. Keygraph requests the minimum scope required for each integration:

• The default scope is read-only on the repositories selected for scanning.
• Write access is requested only when the customer explicitly enables Code Remediation (remediation pull requests).
• Permissions can be revoked at any time from the source control provider's UI without coordination with Keygraph.

Deployment Models

Keygraph Cloud

• Runs on AWS with regional isolation.
• Data residency available in US and EU regions.
• All processing and storage for a tenant remains within the selected region.
• No cross-region replication of customer data.

Self-Hosted

• Full deployment runs inside the customer environment.
• Supports fully airgapped installation with no outbound calls to Keygraph.
• Customer retains end-to-end control of code, scan infrastructure, and findings.
• Suitable for regulated workloads, classified environments, and customers with strict data residency requirements.

Scan Workflow

The end-to-end repository scanning workflow:

1. Select: User or CI pipeline triggers a scan for a configured repository.
2. Provision: The platform provisions a fresh, isolated container with scoped credentials, including a tenant-scoped role for the encrypted S3 artifact bucket.
3. Clone: An isolated, short-lived environment performs a shallow git clone of the target ref into its ephemeral filesystem.
4. Scan: Analysis engines (SAST, secrets, SCA) run against the working copy. Intermediate artifacts required for finding generation are written to the encrypted S3 bucket; the source tree as a whole is not.
5. Encrypt and emit findings: Results are serialized, encrypted in transit, and written to the findings store. Any code snippets attached to findings are encrypted at rest, as are textual descriptions that reference code.
6. Destroy: Container is terminated; ephemeral storage holding the working copy is wiped.

The container is single-use. No reuse across repositories, customers, or scan runs.

Code Retention: Disclosure

Keygraph does not persist the full source tree. A small set of features requires retaining specific code fragments or code-derived data, and the categories below are the exhaustive list: if a category of code or code-derived data is not listed here, it is not retained. All retained data, including any descriptive text that references code, is encrypted at rest.

Code Snippets for Findings

To display findings in the UI with surrounding context, Keygraph stores short code snippets associated with each issue:

• Snippets cover only the lines relevant to the finding plus a small surrounding window.
• Snippets are stored encrypted at rest.
• Snippets are scoped to the tenant and the specific finding; they are not used for any cross-tenant function.

Intermediate Analysis Artifacts

Some scan engines emit intermediate artifacts (for example, dependency graphs, SBOM data, parsed configuration, and engine-specific working state) that are required to produce findings, deduplicate across runs, and support triage workflows.

• These artifacts are written to a tenant-isolated, encrypted-at-rest S3 bucket.
• The full source tree is not part of these artifacts.
• Retention is bounded by the tenant's data retention policy.

Code Remediation

When Code Remediation is enabled, Keygraph stores diffs for files that are part of a proposed fix:

• Original code, limited to the files being modified.
• Remediated code, the proposed replacement.
• Files outside the fix scope are not retained.

This data is required to render diffs in the UI and to open pull requests against the source repository.

SAST Findings (AST)

For each SAST finding, Keygraph stores an Abstract Syntax Tree (AST) representation of the relevant code region. The AST is used for:

• Finding deduplication across scans.
• Taint flow visualization in the UI.

ASTs are written to the same tenant-isolated, encrypted-at-rest S3 bucket used for intermediate analysis artifacts. Raw source files are not retained; only the AST fragment associated with the finding.

Encryption

All retained code-derived data, including code snippets, intermediate artifacts, Code Remediation diffs, SAST ASTs, and any descriptive text that references code, is encrypted at rest using AES-256, with keys managed in a regional key management service (KMS). All integration and API traffic is encrypted in transit using TLS 1.2 or higher.

Summary

Keygraph Cloud compared with Self-Hosted deployment

Property	Keygraph Cloud	Self-Hosted
Full source tree stored	No	No (customer controlled)
Code-derived data persisted	Snippets, intermediate artifacts, Code Remediation diffs, SAST ASTs (all encrypted)	Customer controlled
Network egress	To Keygraph control plane only	Optional / airgap supported
Data residency	US or EU region	Customer environment
Default integration scope	Read-only	Read-only
Container lifecycle	Ephemeral, single-use per scan	Ephemeral, single-use per scan
Encryption at rest	AES-256, regional KMS	Customer-managed KMS supported
Encryption in transit	TLS 1.2+	TLS 1.2+

Posture Statement

Source code should leave the customer's perimeter only when the whitebox pentest's source-informed analysis requires it, for the shortest possible duration, and it should never land in a shared or persistent store. Where code-derived state must be retained to deliver a feature, the retained surface is narrow, encrypted at rest, scoped to the tenant and to the feature that requires it, and revocable.

For audit-ready documentation supporting vendor security assessments and third-party risk reviews, including key management and incident response procedures, contact security@keygraph.io.