Your data

What we collect and why

We keep your account and workspace details, permissions, consent choices, billing and usage records to provide Lockpick and protect access.

Website scans

Pulse and hosted Deep read public pages, scripts and domain records. We keep results and redacted evidence to show findings and track repairs. Quick checks expire after 7 days by default.

ZIP uploads

Your archive reaches Lockpick. Configured AI review sends selected, redacted file text and paths to Anthropic. Raw chunks are deleted after completion, failure or removal, and become eligible for cleanup after one hour even if a Full review is paused. Continuing an expired review requires a new upload. Stored ZIP reports omit source quotations and expire after 30 days when complete or failed. Provider and backup copies have separate retention.

Automated redaction may miss sensitive values. Do not upload credentials or unrelated personal data. Dependency checks can send package names and versions to OSV.

Deep Local

Source files and reports stay on your machine. Lockpick receives the project, requested checks and scanner versions to authorize the scan and records that authorization. If you share results with an AI assistant, its provider receives what you share.

CLI commands

Dependencies and connected repositories

Monitor keeps package names and versions you send. A connected repository also supplies repository and commit details plus the selected manifest and lockfile for dependency analysis. Public repository and skill checks read the code you select; AI review can send redacted excerpts to Anthropic.

Ask Lockpick

Questions and recent messages go to Gemini and, when answer matching is enabled, TypeSafe. TypeSafe may receive site names and addresses to match an account question. Answer metadata is kept for 30 days; question text storage is off by default.

Cookies and optional analytics

Sign-in cookies are needed to run your account. Optional analytics and masked session replay require your consent. Change that choice here; browser Do Not Track and Global Privacy Control are respected. Cookie settings.

Anonymized vulnerability training

We train Lockpick’s defensive security model on anonymized vulnerability findings. We do not use your source code, product ideas, account details or identifying information for training. Anonymized training records contain only a supported weakness category, severity and evidence classification; they contain no code, paths, domains, customer identifiers or free-text reasons. Earlier reports collected under our no-training promise are excluded.

Access, export or delete your data

Use the contact details in the Privacy Policy to request a copy, correction or deletion of your data, or account closure. We confirm your identity before acting.

Removing a site stops watching it; it does not erase past scans. Deleted data can remain in backups until those backups are replaced. See the policy for retention details.

View privacy & data · Privacy Policy

Where

Lockpick runs on servers in the United States. It uses a small set of providers to run, for example to host the service and send email, and each one is named in the Privacy Policy.

Sharing a result

A share link shows only your score, your grade and the titles of what's worth fixing. The evidence and the fixes stay private, and Stop sharing turns the link off.