Clarify ScanCode Toolkit data-handling practices.

[pombredanne]

Hello,

We are evaluating ScanCode Toolkit for auditing proprietary commercial source code and would like to clarify its data-handling practices.

Could you please confirm:

• Whether it is free?
• Whether any source code or scripts scanned with ScanCode are ever uploaded, transmitted, stored, retained, logged, or cached by ScanCode, AboutCode, or any service provider
• Whether ScanCode performs any external network communication during a normal local scan
• Whether scanned code, scan results, hashes, filenames, paths, metadata, or other derived information are used for:
  • analytics or telemetry
  • product improvement
  • benchmarking
  • AI/model training
  • building or improving reference databases
• Whether any third-party/subprocessor receives project-related information
• Your applicable data retention and deletion policy
• Whether a fully local/offline scan can be performed with no project data leaving our environment

Our main requirement is to ensure that confidential proprietary source code remains fully under our control during scanning.

Best regards,

[pombredanne]

Hi: there are three ways to answer this:

1. I could point you to our documentation and license, and this should enable you to answer these questions
2. I can answer them briefly here to make it easier for you
3. I could ask you to engage us commercially to provide commercially-backed answers

Let me do 2. for now:

• Whether it is free?

Yes, as in free, libre and open source, using the Apache-20 license as the primary license.

• Whether any source code or scripts scanned with ScanCode are ever uploaded, transmitted, stored, retained, logged, or cached by ScanCode, AboutCode, or any service provider

Almost nothing, as there is one exception. The code in https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/scancode/outdated.py calls pypi.org (managed by the Python Software Foundation) to find out what is the latest version of ScanCode toolkit. We do not know when this happens, and have no access to any logs of Pypi.org and no data is transferred in the PyPI API call, and nothing is transferred to us either. You can use the --no-check-version CLI option to disable this to bypass live, remote outdated version check on PyPI.

• Whether ScanCode performs any external network communication during a normal local scan

Nothing. Zilch. Nada. کچھ نہیں. Rien. 没什么. Niente. لا شيء. Nichts. Zero.

• Whether scanned code, scan results, hashes, filenames, paths, metadata, or other derived information are used for:
  • analytics or telemetry
  • product improvement
  • benchmarking
  • AI/model training
  • building or improving reference databases

Nope. Nothing. We do not have access to the data. I wish we had access to some of that sometimes to improve ScanCode, but it is not available and nothing is shared nor going out.

• Whether any third-party/subprocessor receives project-related information

No. None. Nobody.

• Your applicable data retention and deletion policy

We neither retain, nor receive any data, so therefore we have no data retention, and no retention policy since there is no data.

• Whether a fully local/offline scan can be performed with no project data leaving our environment

Yes. Nothing leaves your place from running ScanCode. Running 100% air-gapped works fine. ScanCode is running air-gapped in several of the largest tech companies and many users run it isolated.

We are an open source community backed by a non-profit foundation, so everything including these claims are provided as-is and without warranty, but hey! this is open source, so you can verify all that in the code.

And your financial support would be highly welcomed of course to help us sustain our operations and efforts if your customers want a contractual, commercial warranty or representation of sorts

I strongly encourage you to also checkout ScanCode.io that embeds ScanCode Toolkit in a nice UI, and scripted pipelines.

There, same thing applies, nothing goes out and everything can run air-gapped.