Privacy

Last updated 10 September 2026

Suricate watches the libraries, providers and services your project depends on, and emails you when one of them announces something that breaks. To do that it needs to know what you depend on. This page says exactly what that means, and what it does not.

What we read from your repository

The GitHub App holds three permissions, and no others:

• Contents, read-only — the files listed below
• Metadata, read-only — GitHub attaches this to every app; it exposes repository names, branches and languages
• Email addresses, read-only — an account permission, not a repository one. The product is an email; without it we have nowhere to send anything.

Within Contents, we deliberately open a short list of files:

• package.json, including sub-manifests in a monorepo
• your lockfile — package-lock.json, pnpm-lock.yaml or yarn.lock
• files that declare a Node version: .nvmrc, .node-version, vercel.json, Dockerfile, CI workflows

We never read your source code. Not to index it, not to search it, not to train anything. The list above is enforced in the code that plans each scan, and no other path can widen it.

What we store

• your email address and your GitHub account id
• the name of the repository you connected and its default branch
• the dependencies we found, with their versions and the workspace they live in
• the services and models you declared by hand
• the alerts we sent you, and whether you marked one useful

We store no GitHub token. Access is minted from our own key when a scan runs and expires within the hour, so there is no long-lived credential to your repository sitting in our database.

The team-plan waiting list

Leaving an address on the waiting list creates no account, grants us no access to any repository, and is stored separately from everything above. We keep the address and the date, and nothing else — not the page you came from, not your IP, not a name. It is used once, to tell you the team plan has opened, and for nothing else. Legitimate interest, and asking twice changes nothing.

To be taken off it before then, write to the address on the legal notice — there is no account to delete, so it is not self-service. We remove it and reply. If you also hold an account, deleting it removes a matching waiting-list address at the same time.

We keep it until the team plan opens and that one email goes out, and we delete the list afterwards. If the plan never opens, the list goes with the service.

Why we are allowed to

Performing the contract you entered into when you created an account, for everything needed to watch your stack and email you. Legitimate interest for service emails about your own account — an alert, a delivery problem, an access we lost.

Who else touches it

• Vercel — hosting. American company, functions pinned to an EU region.
• Neon — database, eu-central-1
• Resend — email delivery, Ireland
• GitHub — the source of what we read, at your instruction

Nobody buys this data and nobody advertises against it. There is no analytics vendor and no tracking pixel in the emails.

Cookies

Three, all of them strictly necessary to sign you in and to keep the sign-in itself safe: a session cookie, a return address, and an anti-forgery token. Nothing tracks you across sites, which is why there is no banner asking you to accept anything.

How long

As long as your account exists. Delete it and everything above goes with it — see below.

Deleting everything

From your account page, in one step. It deletes your projects, the dependencies we read, the services you declared and every alert we ever sent. It also removes the Suricate app from your GitHub account, so we cannot read anything there afterwards even if we wanted to. You get one last email confirming it, and nothing of yours stays in our database. See Logs for what our host and our email provider keep on their own side, which we do not control.

You can also uninstall the app from GitHub yourself at any time. We detect it, stop checking, and tell you rather than failing in silence.

Logs

Our host keeps request logs, which contain IP addresses, and our email provider keeps a record of every message sent to you — recipient, subject and body — for its own delivery reporting. Neither is under our control and both outlive your account. We do not read them for anything but debugging a fault.

Database backups roll for a short window, so a deleted account can persist in a backup until that window passes. It is never restored to serve anyone.

Where the data is

The database and email delivery are in the European Union — Neon in eu-central-1, Resend in Ireland. Serverless functions run in the EU by configuration.

Two companies in this list are American: Vercel, which hosts the site, and GitHub, which is the source of everything we read and where you already keep your code. Both are on the EU–US Data Privacy Framework.

Your rights

Erasure is one click on your account page and needs no request. For access, correction, portability or objection, write to the address on the legal notice — those are not self-service yet, and pretending otherwise would be worse than saying so. We answer within a month.

Your email address and GitHub account come from GitHub itself: changing them there changes them here on your next sign-in. If you are not satisfied with how we handle a request, you can complain to the CNIL.

Changes to this page

If what we read or store ever changes, this page changes first and the date above moves. A change that widens what we open will be announced by email before it happens.