Skip to main content
At Endor Labs, safeguarding your data is our priority. We believe that transparency builds trust, so we’re upfront about what data we handle, how we process it, and most importantly, what we don’t do! The data that Endor Labs handles varies depending on the product you use, your deployment model, and your configured integrations. As Endor Labs adds capabilities and products, these data handling practices change with them, and Endor Labs keeps this page up to date.

​
Deployment models

Endor Labs has the following deployment models:
  • Hybrid scanning: Customers can run Endor Labs CLI in their CI/CD environment. While using a hybrid scanning strategy, analysis of your software is performed inside your environment on the compute environment where a scan is running. Metadata associated with the scan types you run are then sent back to Endor Labs cloud environment to your hosted tenant and stored for analysis.
  • Cloud scanning: Customers can integrate and deploy Endor Labs using a cloud-based scanning solution, such as the Endor Labs GitHub App. When using this approach, Endor Labs is granted access to your source code and SCM to enable continuous scanning of changes to your software and SCM configuration. During the scan, repositories are cloned into a dedicated ephemeral container, which operates in a secure and isolated environment. Once the scan is complete, the container and all associated data are deleted. The source code is removed after each scan, and only the metadata related to the scan is retained.
  • Outpost: Customers whose policies prevent exposing source code to the public cloud can deploy Outpost, an on-premises instance of the Endor Labs scheduler that runs in your own Kubernetes cluster. Endor Labs schedules the scans, and both the scheduling and the scans themselves happen inside your firewall. Repositories are cloned into your cluster rather than into an Endor Labs environment, so your source code stays within your network. After a scan completes, only the scan results are sent back to Endor Labs cloud environment to your hosted tenant.

​
Regions and Data Residency

Endor Labs runs on Microsoft Azure, MongoDB Atlas, and Google Cloud. Your tenant is hosted in one of two regions, which is set when you onboard. Your region determines the endpoints you use and where each of these services holds your data. Your tenant data stays in your region. This includes your findings, scan metadata, call graphs, and the vector embeddings that AI SAST generates. Endor Labs also operates shared open source services in the United States that hold package metadata, such as package names, versions, and vulnerability information. Tenants in both regions query these services. A lookup carries the names and versions of the dependencies in your scan, and nothing else from your tenant.

​
Data residency in EU

Endor Labs offers a dedicated EU-hosted environment for customers who require EU data residency. When you onboard as an EU tenant, your organization’s data is stored and processed in the EU region. AI requests for EU tenants are served from EU regions by Microsoft Azure OpenAI Service and Google Cloud Vertex AI. Some data leaves the EU region in the following cases.
  • Open source lookups: Each lookup against the shared open source services in the United States carries the names and versions of the dependencies in your scan. It carries nothing else from your tenant.
  • Scan logs: Logs from the scans that Endor Labs runs on the EU cluster stay in the EU, in europe-west3. Logs from the scans you run with endorctl in your own CI environment go to a global Google Cloud Logging bucket that is not EU-resident. These are diagnostic logs, and Endor Labs redacts secrets from them. You can turn Remote Logging off in your data privacy settings.
  • Patch requests: When you request an Endor Patch, Endor Labs copies the request to the open source service in the United States without your contact details or your comment. Endor Labs sends the contact email addresses on the request to an internal channel so that the team can act on it.
Contact your Endor Labs account team for onboarding instructions and current limitations.

​
Data stored by all products

  • Finding data: Endor Labs stores information required to report on findings to on their customers security or operational risks such as vulnerability or misconfiguration information.
  • Finding location: Endor Labs stores information required to identify the location of a finding so that corrective action may take place. This includes information such as the repository name, file name, and issue location.
  • Integration information: Endor Labs stores information required for operation of external integrations with third parties such as Jira. These include configuration and authentication information.
  • Identity information: Endor Labs stores identity claim information required to access and use the platform, such as email address and group claims sent by an external identity provider.
  • User telemetry: Endor Labs stores information about your usage of Endor Labs such as platform usage and scan configuration.

​
Data sent to LLM providers

Endor Labs features that rely on large language models (LLMs) are served by a combination of third-party providers rather than by any single provider. Depending on the feature, the model, and your tenant’s region, a request may be served by any of the following:
  • Microsoft Azure OpenAI Service
  • Google Cloud Vertex AI
  • OpenAI
Endor Labs routes each request to a provider that serves the required model, and may fail over to another provider to keep a feature available. Code segment embeddings and LLM processing are an exception to this routing, and run on a private Azure OpenAI Service deployment. Routing and failover are subject to the regional rules described in Regions and Data Residency. For the current list of providers Endor Labs uses, see Endor Labs Sub-processors. These features are optional. The Code Segment Embeddings and LLM Processing setting in data privacy settings is off by default and applies to every scan in your tenant. AI SAST can be enabled or disabled in the scan profile assigned to a project, so you control it per project.

​
Data stored by each product

Select your product to see the scans it includes and the data Endor Labs stores for them.

​
Endor Labs Policy and Transparency Information

For additional information, see the following relevant pages on how Endor Labs handles your data: