This is a summary written for a practitioner. The security page is the fuller statement, and it is the one to send to a counterparty's security team.
Where material is processed
Percomb is a hosted product. Depending on how your deployment is configured, analysis runs on infrastructure we operate or routes to hosted model providers. Either way, your documents are never used to train models, and we state which providers a deployment uses, in writing, on request.
If you have seen an older help article claiming your material is processed on your own hardware and stays inside your own network: that was wrong, it has been removed, and this article replaces it. Where your data physically sits and which models process it depends on how you are deployed — ask us and we will put both in writing.
Source code
We never hold the target's source. Repository evidence comes from an extract the target produces inside their own network; the platform holds no credentials to any source host. See Source code analysis.
Isolation
- Between firms. Each workspace's data is separated at the database level, not merely filtered in application code.
- Inside a project. The target's contributors, the repository provider, your reviewers and an external reader each see only their own slice. A target that uploads documents cannot see findings; an external reader with a share link reaches one issued report and nothing behind it.
- Share links expire, and are stored only as a hash — the raw token is nowhere in the database, so a link cannot be replayed after it has been used.
Deletion
Deleting a document removes it from the project and from the index. Deleting a project removes its material. If you need a documented deletion — for a closed transaction, or because a target has asked — raise a support ticket and we will confirm what was removed and when.
What we do not claim
- No completed third-party certification. We do not hold one and will not imply one. Tell us where you are in your process and we will tell you where we are in ours.
- No penetration test cited. We would rather say nothing than cite a scan and call it a test.
That honesty is deliberate: you are selling a defensible report to an investment committee, and a vendor who overstates its own controls is a poor foundation for that.