Privacy

Last updated 19 October 2026

Suricate watches the libraries, providers and services your project depends on, and emails you when one of them announces something that breaks. To do that it needs to know what you depend on. This page says exactly what that means, and what it does not.

What we read from your repository

The GitHub App holds three permissions, and no others:

  • Contents, read-only — the files listed below
  • Metadata, read-only — GitHub attaches this to every app; it exposes repository names, branches and languages
  • Email addresses, read-only — an account permission, not a repository one. The product is an email; without it we have nowhere to send anything.

Within Contents, we deliberately open a short list of files:

  • package.json, including sub-manifests in a monorepo
  • your lockfile — package-lock.json, pnpm-lock.yaml or yarn.lock
  • files that declare a Node version: .nvmrc, .node-version, vercel.json, Dockerfile, CI workflows

We never read your source code. Not to index it, not to search it, not to train anything. The list above is enforced in the code that plans each scan, and no other path can widen it.

What we store

  • your email address and your GitHub account id
  • the name of the repository you connected and its default branch
  • the dependencies we found, with their versions and the workspace they live in
  • the services and models you declared by hand
  • the names you asked us to watch that we do not watch yet, with the date you asked, the link to the site or changelog if you gave one, and what we decided: the vendor we added it as and whether the one email saying so went out, or the one-line reason we did not add it. We keep this so we know what to add next, can email you once when we add it, and can show you in the app what became of each request
  • the alerts we sent you, and whether you marked one useful
  • the language you picked for the interface, if you picked one

We store no GitHub token. Access is minted from our own key when a scan runs and expires within the hour, so there is no long-lived credential to your repository sitting in our database.

The team-plan waiting list

Leaving an address on the waiting list creates no account, grants us no access to any repository, and is stored separately from everything above. We keep the address and the date, and nothing else — not the page you came from, not your IP, not a name. It is used once, to tell you the team plan has opened, and for nothing else. Legitimate interest, and asking twice changes nothing.

To be taken off it before then, write to the address on the legal notice — there is no account to delete, so it is not self-service. We remove it and reply. If you also hold an account, deleting it removes a matching waiting-list address at the same time.

We keep it until the team plan opens and that one email goes out, and we delete the list afterwards. If the plan never opens, the list goes with the service.

Why we are allowed to

Performing the contract you entered into when you created an account, for everything needed to watch your stack and email you. Legitimate interest for service emails about your own account — an alert, a delivery problem, an access we lost.

Who else touches it

  • Vercel — hosting. American company, functions pinned to an EU region.
  • Neon — database, eu-central-1
  • Resend — email delivery. American company. Our domain sends from Ireland, but the stored record of each message is in the United States either way.
  • GitHub — the source of what we read, at your instruction
  • Sentry — error monitoring for our servers. American company; our project stores its data in the EU, in Frankfurt. It receives what failed, where in our code, and the identifiers we attach, such as a project id. Email addresses, URL parameters, cookies and request bodies are removed before a report leaves. Nothing is sent from your browser.

Nobody buys this data and nobody advertises against it. There is no analytics vendor and no tracking pixel in the emails.

Cookies

Five at most, all set by suricate.dev itself, and none of them follows you to another site. Four exist only to sign you in and to keep the sign-in safe:

  • __Secure-authjs.session-token — keeps you signed in, until 30 days after you last signed in
  • __Host-authjs.csrf-token — an anti-forgery token; a session cookie, with no expiry date
  • __Secure-authjs.callback-url — the page to bring you back to after signing in; a session cookie, with no expiry date
  • __Secure-authjs.pkce.code_verifier — a one-time secret proving that the answer coming back from GitHub belongs to the sign-in you started; it expires after 15 minutes

The fifth, locale, appears only if you pick a language. It remembers that choice for a year, and nothing else.

French law exempts all five from consent, as the CNIL reads it: the first four authenticate you and secure that authentication, and the last one is a language choice, part of a service offered in two languages, that you made yourself (CNIL, “Que dit la loi ?”, read on 13 October 2026). That is why there is no banner asking you to accept anything. If we ever add a cookie that needs your consent, this list changes first and the banner comes with it.

One exception, which is not ours: if the site is ever under attack and we switch on our host’s protection, Vercel asks your browser to pass a check and remembers for an hour that it did. Vercel sets it, not us, and it only serves to keep automated traffic out (Vercel’s own documentation, read on 14 October 2026).

How long

As long as your account exists. Delete it and everything above goes with it — see below. Error reports at Sentry expire after 30 days on their own.

Deleting everything

From your account page, in one step. It deletes your projects, the dependencies we read, the services you declared, the names you asked us to watch and every alert we ever sent. It also removes the Suricate app from your GitHub account, so we cannot read anything there afterwards even if we wanted to. An installation on an organisation stays, because it belongs to the organisation and not to you: we forget it, and an admin of the organisation can remove it on GitHub. You get one last email confirming it, and nothing of yours stays in our database. See Logs for what our host and our email provider keep on their own side, which we do not control.

You can also uninstall the app from GitHub yourself at any time. We detect it, stop checking, and tell you rather than failing in silence: by email, unless you unsubscribed, and on your dashboard. Reinstall it and we re-read your repository and resume.

Logs

Our host keeps request logs, which contain IP addresses, and our email provider keeps a record of every message sent to you — recipient, subject and body — in the United States, for its own delivery reporting. Neither is under our control and both outlive your account. We do not read them for anything but debugging a fault. Deleting your account sends you one last email saying so, which creates one more such record.

Our database keeps a six-hour point-in-time restore window, so a deleted account can persist in it until that window passes. It is never restored to serve anyone.

Where the data is

Our own copy of everything we hold about your stack — your account, your repository, the dependencies we read, the alerts we wrote — is in the European Union: Neon in eu-central-1.

Serverless functions run in the EU by configuration: cdg1, Paris. That setting governs where our code runs, not where Vercel keeps its own request logs.

Your emails are the exception, and the body is not just prose. Resend sends them and keeps its own record of each one — recipient, subject, and a body that names your repository, the workspaces a dependency sits in and its installed version. That record is in the United States. Our domain is set to send from Ireland, which changes where the message is dispatched from, not where the record is kept: there is no setting today that moves the stored copy to the EU.

So four companies in this list are American: Vercel, which hosts the site, GitHub, which is the source of everything we read and where you already keep your code, Resend, and Sentry, whose stored copy stays in Frankfurt. All four have certified to the U.S. Department of Commerce that they adhere to the EU–US Data Privacy Framework Principles and appear on the Department’s own list; the transfer to Resend is additionally covered by the Standard Contractual Clauses in its data processing agreement.

Checked on 12 October 2026. Our own settings: the Vercel region is pinned in vercel.json, the Neon region is in the connection host, and the restore window and the Resend sending region were read from their consoles, the Sentry storage region from its organisation settings. Everything else — the retention figure, the certifications, where Resend stores what it stores — comes from Neon, Resend, Vercel, GitHub and Sentry’s own documentation.

Your rights

Erasure is one click on your account page and needs no request. For access, correction, portability or objection, write to the address on the legal notice — those are not self-service yet, and pretending otherwise would be worse than saying so. We answer within a month.

Your email address and GitHub account come from GitHub itself: changing them there changes them here on your next sign-in. If you are not satisfied with how we handle a request, you can complain to the CNIL.

Changes to this page

If what we read or store ever changes, this page changes first and the date above moves. A change that widens what we open will be announced by email before it happens.