- Effective date
- September 4, 2026
- Applies to
- All Apex trial engagements initiated in a workspace created via a private Cantina trial link ("Apex Trial Engagements").
Cantina publishes this policy so that any organization evaluating Apex knows exactly how its source code, repositories, and findings are handled. This policy is a binding commitment by Cantina to every Apex prospective customer. It requires no signature: by providing you access to Apex, Cantina agrees to be bound by it. Where this policy conflicts with Cantina's General Terms of Use, this policy controls for Apex Engagements.
Customer Confidential Information
Everything you give Apex and everything Apex produces for you is Customer Confidential Information. This includes source code, repositories, commit history, configuration, documentation, architecture details, credentials or tokens incidentally present in a codebase, vulnerability findings, severity assessments, remediation guidance, and the fact that you are evaluating Apex at all.
No marking, labeling, or notice is required. If it came from you or was generated about your code, it is confidential.
Our confidentiality commitments
- We will not disclose your Customer Confidential Information to any third party, except to subprocessors listed in Section 6 acting under equivalent confidentiality obligations, or where required by law (in which case we will notify you promptly unless legally prohibited).
- We will not use your Customer Confidential Information for benchmarking, marketing, case studies, or public disclosures without your prior written consent. Section 7.2 (Data Analytics) of the General Terms of Use does not apply to Apex customer code or findings.
- We will only access the repositories you have explicitly granted us permission to, and this access remains in place for as long as the GitHub app is installed. You can revoke this access at any time by uninstalling the app or adjusting its permissions.
Access to Customer Confidential Information is limited to Cantina personnel who need it to deliver, support, or secure the Apex service for you. Every such person is bound by written confidentiality obligations to Cantina. Access is logged. Independent security researchers on the Cantina marketplace do not have access to Apex customer code unless you separately engage them.
How Apex processes data
Apex processes code in Cantina-managed cloud infrastructure. Analysis runs in isolated Vercel sandboxes. Application data, uploaded source archives, findings, and analysis records are stored in Supabase. Relevant code and analysis context are sent to the configured model providers. Data is encrypted in transit (TLS 1.2+) and at rest. Production access requires multi-factor authentication and follows least-privilege principles.
Retention and deletion
Repository contents are retained only as long as needed to run analysis and deliver findings. Cloned repository data, findings, and reports are retained indefinitely unless manually deleted upon request, in alignment with our internal Data Management Policy. You may request deletion of all Customer Confidential Information at any time by emailing security@cantina.security , and we will confirm deletion in writing within 30 days.
Subprocessors
Cantina uses the following third parties to deliver Apex, each bound by confidentiality and data-processing obligations no less protective than this policy:
- Vercel: cloud hosting and isolated analysis sandboxes.
- Supabase: database, authentication, and source-archive storage.
- Sentry: operational monitoring and error telemetry.
- Anthropic: foundation-model inference, with zero data retention enabled.
- OpenAI: foundation-model inference, with zero data retention enabled.
- GitHub: authorized repository access through the GitHub App.
Subprocessor updates
We will update this list before adding a subprocessor that will handle customer code.
Security assurance
Cantina maintains a SOC 2 Type II report, available under NDA on request via trustcenter.cantina.security . Our vulnerability disclosure and security contact information is at cantina.security/security .
Ownership
You own your code and you own the findings Apex produces about it. Cantina claims no rights in either, other than the limited right to process them to provide the service to you.
Duration
These obligations begin the moment you grant Apex access and continue for two (2) years after your engagement ends, or indefinitely for trade secrets and source code.
Additional agreements
If you require a mutual NDA, data processing agreement, or enterprise agreement, we are happy to execute one. This policy governs in the interim. If we enter into a separate agreement covering the same subject matter, that agreement will supersede this policy.
Policy updates
We may update this policy to strengthen protections. We will not reduce the protections for an active engagement without your written consent. The current version is always published at cantina.security/apex/data-policy .