Your code stays
your code.

codeindexer runs entirely on localhost. The server binds to 127.0.0.1 by default. Indexing, embedding, search, and audit all happen on your machine — there is no cloud control plane to leak into.

Stored on your machine: the index (vectors + symbol tables + call graph), per-project memory cards, license file (mode 0600), and an append-only audit log if you opt in.

Never stored anywhere: raw source contents, search queries, embeddings (other than locally), or your prompts to AI clients. We don't have a database for it. We don't have a bucket for it.

codeindexer is not instrumented with analytics. We don't ship Sentry. We don't ship Mixpanel. We don't ship a crash-reporter that "phones home" — opt-in or otherwise. The Free tier makes zero network calls.

Pro and Enterprise make exactly one HTTPS request per day to verify the license. That request contains a license ID and an anonymous machine fingerprint (hash of stable hardware IDs) — and nothing else. The full payload is documented and reproducible from the source.

If the license server is unreachable, the binary continues to operate normally for a 14-day grace window from the last successful heartbeat — short network outages and travel don't break anything.

macOS builds are signed with our Apple Developer ID and notarized by Apple. Gatekeeper verifies the signature automatically on first launch — no extra steps for you.

Windows builds are signed with our Authenticode certificate. SmartScreen reads the signature; the Publisher field shows NetTechnologys s.r.o.

Linux builds are signed with a minisign Ed25519 key — modern, single-binary verifier, no GPG keyring overhead. Pin the public key once and verify every future release:

RWTdWz65CdhG3MdHuAPjoP1wc+EeBAhKoa8b/eMq+kEaHaLQPmF4FO0g

Verify a Linux release in one command:

Pro and Enterprise licenses are issued as signed JSON files. The binary carries the issuer's public key embedded at build time; license validation is a pure local cryptographic check.

Implementation reference: App\Services\LicenseSigningService handles signing on the issuer side; the binary performs the corresponding verification before unlocking gated tools. Tampering with the license file invalidates the signature; the binary falls back to the Free tier.

The daily heartbeat is a freshness check, not the validation. A license remains usable for a 14-day grace window without network access.

Every dependency is pinned at the lockfile level. We track CVEs on every push via cargo audit, cargo deny, and npm audit on the frontend. A failing audit blocks the release pipeline.

Embedded models (embedding + reranker + optional LLM) are pinned by hash. We don't auto-update model weights at runtime — every version bump is deliberate, documented in the release notes, and signed with the rest of the release.

Update policy: security patches within 7 days of public disclosure; routine dependency bumps quarterly; major version bumps documented in the breaking-change calendar.

Primary channel — GitHub Security Advisories. Open a private advisory at github.com/Nettechnologys/codeindexer/security/advisories/new. Private thread with us, automatic CVE assignment when the fix is ready, coordinated public disclosure on a timeline that suits both sides.

Email fallback. Plain email to [email protected] is fine for non-sensitive triage. If you need an encrypted channel for exploit details before disclosure, request a PGP key in your initial email and we will share one.

We acknowledge within 48 hours, coordinate on embargo timing, and credit reporters in the advisory unless you'd rather stay anonymous. We do not run a paid bounty program. Enterprise customers receive advisories under embargo ahead of public disclosure when the issue warrants it.