What happens to your data in SuperClue?
SuperClue is a hosted service at superclue.io. Your scan results, findings and agent telemetry are stored in the platform database, and some lookups go to named outside services. The answers below list what leaves the platform and how long data is kept.
Where is my data stored?
In the SuperClue platform database behind superclue.io. SuperClue is a hosted service only; there is no on-premise or self-hosted version. The Data Processing page lists the hosting arrangement and our sub-processors.
Is my data encrypted?
Repository access tokens are encrypted before they are stored. CI/CD API keys and agent install tokens are stored only as hashes, and each key is shown to you once. Encryption at rest for the rest of the database depends on the hosting setup and is not applied by the application itself.
Is my code stored after an AI code review?
Your repository is not stored as a whole. Files are fetched for the review and sent to a third-party AI service. We keep the findings, including a short snippet of each flagged line so you can see the issue.
Which outside services receive data from SuperClue?
Code and finding details go to a third-party AI service when you use AI features. Package lists from your agents go to OSV.dev for vulnerability lookups, and IP addresses go to ip-api.com for geolocation. Domains are checked against HaveIBeenPwned and crt.sh in the breach and certificate checks, and CVE ids get scores from FIRST EPSS. During a Nuclei scan, callbacks from the scanned site go to the public ProjectDiscovery interaction servers. Alert emails are sent through our email provider.
Are AbuseIPDB, Shodan or VirusTotal used?
Only if you add your own API keys for them. Without your keys, SuperClue does not use those sources.
How long is data kept?
SOC logs are kept for 180 days by default. Raw telemetry for threat hunting is kept for 7 days, and SIEM delivery logs for 30 days. For other data, such as scan results, ask our data protection officer at dpo@superclue.io.
How are agent updates protected?
Agent files and update manifests are signed with Ed25519. The agent checks the signature and the SHA-256 hash before it installs an update.
Do you support single sign-on (SSO) or SAML?
No. SuperClue does not support SSO or SAML today. Each user signs in with their own SuperClue account.
Read how we run and secure the platform.
View security