Skip to content

Security-review answers

Reusable answers for security questionnaires and vendor assessments. They are deliberately conservative and point at the source behind each claim.

Confirm against your release and licensing terms

These answers reflect the current shipping behavior and are a starting point, not a contract. Behavior and defaults can change between releases, and your license/contract governs the authoritative data-handling terms. Before submitting a completed questionnaire, validate the specifics for your exact build with SciTools at [email protected]. For the precise network endpoint list, see the host summary in What leaves the machine.

Where does my source code go?

Understand is an on-premises desktop/CLI application. Your source code is read locally and the analysis results are written to a local project database (a .und project) on your own storage. Source code is not uploaded to SciTools or any third party in the default configuration. The one exception is if you configure a cloud AI provider — then the prompts you send (which include code context) go to that provider. The bundled local AI keeps code on-device.

Can it run fully air-gapped?

Yes. Installation, analysis, metrics, CodeCheck, reports, and local AI all work with no internet. License the machine offline (offline checkout or node-lock). See Install fully offline and Licensing without internet.

What data does Understand send off the machine?

In a default install, potentially:

  • Anonymous usage analytics to stats.scitools.com — enabled by default. Contains OS/version, build number, license-type string, a random tracking ID, feature-usage events, and project languages. It explicitly contains no source code and no personal data. Can be disabled in Preferences ▸ Privacy & Error Reporting.
  • Licensing data to licensing.scitools.com when licensing online — the user name, device name, and IP address of the seat in use. Avoided by licensing offline.
  • Crash reports to licensing.scitools.com if a crash occurs and reporting is enabled (Windows only, default "ask"). The report is the crash log; an optional Windows dump file may contain "a small amount of proprietary local stack data, like the currently selected variable name."
  • A one-time AI model download from huggingface.co if you use a bundled AI model that isn't already present.

Every item above can be disabled or avoided — see the full host summary and the recommended air-gapped posture for the exact triggers and off switches.

Where is data stored, and is it encrypted?

Analysis results live in the local .und project on your storage; application settings live in the per-user SciTools settings store on the machine. There is no SciTools-hosted storage of your code or analysis in the default configuration. Use your own disk/volume encryption and access controls to protect the project files, as you would any local artifact.

Does it use any third-party / cloud AI by default?

No. The default AI provider runs a local model on-device. Cloud providers (OpenAI, Anthropic, Google, xAI, custom) are opt-in: selecting one requires an API key and an explicit acknowledgement of data sharing, and Understand enforces HTTPS for keyed endpoints. See What can the AI access? and Local AI with no cloud calls.

GDPR / data deletion

  • The analytics identifier is a random UUID generated on the machine, not your name or email; it is not linked to a personal identity by Understand. Turn analytics off to stop collection.
  • Online licensing records user name, device name, and IP address for seat management. To stop that collection, use offline checkout (per Understand's own Privacy page) or contact SciTools.
  • For deletion or access requests covering data held by SciTools (licensing records, any crash reports you submitted), contact [email protected]. Local project data is under your control — delete the .und project to remove it.

Who do we contact for a formal review?

SciTools support at [email protected]. See also How do I get help / contact support?.