Reference
Data Collection
What leaves your systems when you connect a repository or add a client, as of 12 September 2026. For rights, retention and requests, read the Privacy Policy.
Repository scans
A scan reads files through the connected provider's API. It uses dependency manifests and repository metadata to map packages to vendors. Import analysis can also fetch source files that use those packages and their wrappers.
Selected source files can be stored in full. Import-analysis records include the full contents of selected files that import vendor packages and supported wrappers, alongside file paths, package names, line numbers and structured code metadata.
Incident analysis selects source context from these records for prompts sent to Anthropic, OpenAI or Google, depending on which providers are configured. The prompt limits how much context is sent; it does not limit storage to those excerpts. Connecting a repository shares more than a list of package names.
Connect only repositories you are authorized to share. See repository access and OAuth scopes before granting access.
SDK event fields
These fields describe the TypeScript server and browser SDK implementations. Check SDK availability for your language; clients can differ.
| Field | What it contains |
|---|---|
service, endpoint | Vendor or host identification and the request path. |
method, status, error_class | HTTP method, status code and outcome classification. |
latency_ms, ts | Request duration in milliseconds and event timestamp. |
environment, feature, tags | Context configured or attached by your application. |
sdk_version | The client version sending the event. |
The interceptors do not capture request bodies, response bodies or request headers. URL query strings and fragments are excluded from the captured path.
A path can still contain personal data. The browser sends the raw pathname. The server normalizes common identifiers in paths, but that is not a guarantee of removing every sensitive value. Treat path segments, feature names and tags as data you are sharing.
Additional server SDK context
The server SDK can include region, deployment_id and runtime. Environment, region and deployment ID can be inferred from deployment-provider environment variables. A deployment ID can be a full commit SHA; it is not limited to an explicitly supplied eight-character value.
A batch can also include sample_rate and rolling latency/error baselines. Ingest validates baseline summaries but does not currently persist those client-sent summaries.
Request samples and vendor accounts
For monitored requests that return a 5xx response, SDKs can read an allowlisted vendor request-ID response header, such as cf-ray or stripe-request-id. Browser access also depends on the vendor exposing that header through CORS.
A sample contains host, pathTemplate, method, status, headerName, requestId and ts. The default is at most 10 samples per batch. Set maxRequestSamplesPerBatch: 0 to disable collection.
If you configure vendorAccountIds, those identifiers are sent verbatim in vendor_account_ids. Omit the configuration if you do not want to send them.
Event filtering does not filter the whole batch. The browser's beforeSend callback receives events, not the separate request-sample or vendor-account fields. Review those settings separately when deciding what to send.
Measurements are aggregated by the ingest pipeline. Bounded request-ID samples and configured vendor account identifiers can be retained alongside those aggregates; telemetry is not exclusively anonymous counters.
Account and OAuth connections
Signing in creates account, identity and session records. GitHub requests repo, read:org and read:user; GitLab requests read_api, read_user and read_repository. Provider credentials support subsequent repository access.
GitHub's repo scope is broader than read-only access. Review the provider consent screen and any organization approval requirements. Credentials & Security explains the differences between provider access, SDK keys, API tokens and MCP grants.
Account deletion
Delete your account from Settings → Account → Delete Account. This removes your personal account data and organizations where you are the only member, including their repositories, stored source-code content, alert configurations and telemetry data.
Shared-team repository data remains. Deleting your account removes your membership; it does not delete shared organizations or their repository data, including stored source-code content. If you are the last administrator of a shared organization, transfer ownership before deleting your account.
The Privacy Policy sets the deletion deadline of 30 days, except where retention is required by law. For a data-removal request, email [email protected] (opens in new tab).
MCP requests and audit records
A tool call sends its name and arguments to CheckUpstream. The selected tool determines which organization data it reads or changes and what it returns to the connected client.
Transport audit records can include the tool name, organization and actor identifiers, scopes, HTTP method, outcome, timestamp, IP address and user-agent string. Authentication failures are also audited. Successful stream reconnects are excluded from the action log.
Do not put secrets or unrelated personal information in tool arguments. Review the MCP setup guide and the permissions you grant to the client.
Product usage and service providers
When configured, PostHog records page visits, interaction events and the current URL, including its query string. It uses local storage and cookies; session recording is disabled in the app configuration. Vercel provides page analytics and performance reporting, and Sentry receives application errors. Avoid putting secrets in URLs.
Repository jobs, telemetry processing, hosting, database storage, email and billing also involve service providers. The Privacy Policy describes the published processor commitments.
For a privacy request, email [email protected] (opens in new tab). To report a vulnerability, use the Security Policy.