Question 1

How do I get access to ProvenanceOS?

Accepted Answer

Create an account and start a 14-day Launch or Growth trial from the pricing page. A payment card is not required to start the trial. If no payment method is on file when the trial ends, the subscription is cancelled and you are not charged. The Control plan is sales-led.

Question 2

Is self-serve signup open?

Accepted Answer

Yes. Launch and Growth signup and checkout are open. The trial is 14 days. Control is not sold through self-serve checkout.

Question 3

Do you offer discounts for startups or nonprofits?

Accepted Answer

Yes. Contact us at support@provenance-os.com for startup and nonprofit pricing.

Question 4

Is my code data secure?

Accepted Answer

Selected supported dependency manifests and a bounded sample of source files (up to 40 files / 512 KB) are processed transiently and never retained; only the sampled files' paths are stored with the result. ProvenanceOS stores scan metadata and results — and, when connected, the organization's GitHub token, encrypted at rest — not a repository mirror. All data is encrypted in transit (TLS 1.3) and encrypted at rest by our infrastructure providers (InsForge and Railway), and the platform is built to SOC 2 controls.

Question 5

What repositories do you support?

Accepted Answer

Public GitHub, GitLab, and Bitbucket repository URLs can be scanned today. Private GitHub repositories scan with a connected GitHub token. Private GitLab and Bitbucket repositories, and GitLab or Bitbucket account connections, are not available.

Question 6

What compliance standards are supported?

Accepted Answer

SOC 2 compliance reports are planned. EU AI Act, GDPR, HIPAA, and SLSA Level 3 reporting is planned for later phases. The platform is built to SOC 2 controls today.

Question 7

How does scanning work today?

Accepted Answer

Authenticated scan intake is live now: submit a public GitHub, GitLab, or Bitbucket repository URL and ProvenanceOS creates a durable, queued scan job with npm and PyPI dependency resolution, OSV.dev vulnerability matching, AI-origin scoring over a bounded source sample, and policy evaluation. Private GitHub repositories scan with a connected GitHub token. Compliance report generation is planned.

Data type	Processed	Retained	Retention	Third-party access
Source files	Yes, transiently. To compute the AI-origin score, each scan fetches a bounded sample of the repository's JavaScript, TypeScript, and Python source files (up to 40 files / 512 KB in total, 128 KB per file, within a 20-second budget) from the repository host at its default branch, crawled from the package entry points. Vendored, generated, minified, and lock files are never fetched. File content is held in memory only while the scan runs. Archive and source-file uploads are not available.	Content: no. Sampled file paths: yes.	File content is discarded when the scan completes and is never written to storage, logs, or a repository mirror. The repository-relative paths of the sampled files (not their content), with the file and byte counts and the caps applied, are stored with the scan result so the score's coverage can be shown, and are deleted with the job or on account deletion.	None beyond the repository's provider (GitHub, GitLab, or Bitbucket) that serves the files. Source content is scored in-process; it is not sent to OSV, an AI model provider, or any other third party.
Repository metadata	Yes. A GitHub, GitLab, or Bitbucket repository URL and provider are read to create a durable scan job. Public repositories scan directly; private GitHub repositories scan with a connected GitHub token (Integrations → GitHub).	Yes	Retained for the life of the account so job history is queryable. Deleted on account deletion.	Hosted on InsForge (managed Postgres). The repository's provider serves the dependency manifests and the sampled source files for the scan.
Derived signals	Yes. Supported npm and PyPI dependency manifests are read transiently, packages are checked against OSV, and dependency and vulnerability results are stored with the scan. The AI-origin score (score, confidence, contributing stylometric signals, and sample coverage) and the policy evaluation computed from the same scan are stored with it.	Yes	Retained with the scan job so results remain queryable. A completed scan can be exported as CycloneDX JSON. Deleted with the job or on account deletion.	Stored in ProvenanceOS infrastructure (InsForge managed Postgres). Only dependency identifiers are sent to OSV. Not shared with other third parties.
Reports	No. Compliance reports are planned. CycloneDX is a completed-scan dependency export, not a compliance report.	No	Not applicable. ProvenanceOS does not generate or retain compliance reports today.	None. A CycloneDX export is generated for download only after a completed scan.
Credentials/tokens	Optional. The organization can connect a GitHub personal access token (Integrations → GitHub) so scans can read private repositories the token can access. On connect the token is validated against the GitHub API, then stored encrypted at rest (AES-256-GCM, key held server-side) and used only by the scan worker to read repositories for that organization's own scans.	The token: yes — encrypted at rest. It is displayed to users only as its last four characters. No other repository-provider credentials or tokens are collected.	Stored until the organization disconnects the token (Integrations → GitHub → Disconnect), which deletes the stored copy immediately. Deleted on account deletion.	The token is sent only to GitHub itself, as authorization for the scans the organization authorizes. It is not shared with any other third party. GitLab and Bitbucket tokens are not collected.

We value your privacy

Frequently Asked Questions