We practice what we preach.
The first AI governance company to publish its own assessment. Here's exactly how we handle your code, what we send to AI models, and what we never will.
Self-Assessment Summary
527
AI Detections
33
Findings
48
Controls Mapped
2,230,466
Lines Scanned
Three Tiers of Data Privacy
SaaSVista Scan
StandardCloud-hosted scan — your code stays on GitHub
- ✓ Read-only GitHub API access (fine-grained PAT)
- ✓ Code analyzed in isolated containers
- ✓ Findings stored encrypted at rest (LUKS2 AES-256)
- ✓ No code persisted after scan — only findings retained
LLM: Claude API (Anthropic) for enrichment
SaaSVista Private
PrivateOn-prem VM appliance — your code never leaves your network
- ✓ Runs on your infrastructure (VMware/KVM)
- ✓ Air-gap capable — no internet required
- ✓ Embedded AI model (no external API calls)
- ✓ You control all data, all the time
LLM: Embedded Qwen2.5-7B (runs locally, no cloud)
SaaSVista Sovereign
SovereignFull data sovereignty — code snippets redacted from reports
- ✓ Everything in Private tier, plus:
- ✓ Code snippets auto-redacted from all outputs
- ✓ Only file:line references in reports
- ✓ Transparency log proves what was sent to any LLM
LLM: Embedded model + snippet redaction
What We Never Send to Any LLM
Enforced via SecretsFilter (12 regex patterns) applied before any LLM call. Verified by transparency log with SHA-256 hashes.
Response Kit Preview
Sample questions from our 27-question due diligence response package
How does SaaSVista handle customer source code?
Scan EvidencedRead-only access via GitHub fine-grained PAT. Code is analyzed in memory, never persisted. Only structured findings (file paths, detection types, severity) are stored.
What AI models does SaaSVista use?
Scan EvidencedClaude (Anthropic) for finding enrichment in hosted mode. Embedded Qwen2.5-7B for on-prem appliance. All LLM calls are logged in a transparency log with SHA-256 hashes.
Does SaaSVista comply with NIST AI RMF?
Scan EvidencedYes — 23/23 NIST AI RMF controls are mapped. Our scan produces evidence against GOVERN, MAP, MEASURE, and MANAGE function areas.
Can SaaSVista run without internet access?
ConfirmedYes — the Private and Sovereign tiers run on-prem with an embedded AI model. No external API calls required. Air-gap deployment supported.
Downloads
Want to see what your governance posture looks like?
Book a Governance Assessment