No-Logs Policy — AllScanTool

1. Scope of This Policy

This policy covers what happens to your code and scan results. It does not cover payment processing — that is in our Terms of Sale and Privacy Policy.

This No-Logs Policy applies to all data submitted through the AllScanTool scanning service at allscantool.com, including both free mini-report scans and paid full-report unlocks.

In scope: Source code submitted for scanning, vulnerability findings generated, scan metadata (file types, code size, scan timestamp).

Out of scope: Payment card data (handled by Stripe), payment tokens (transaction artifacts stored in Cloudflare Workers KV — addressed in our Privacy Policy and Terms of Sale).

2. What We Collect

We collect your code for scanning. No accounts, no email required, no profiles.

AllScanTool operates without mandatory user accounts. When you use the Service, we receive the following:

Source code: Pasted or uploaded code submitted for vulnerability scanning
Scan parameters: Language selection (PHP, JavaScript, HTML, CSS, Liquid, plain-text)
Transaction reference: Payment token identifier (only after paid unlock — see Section 3)

We do not collect: email addresses, usernames, passwords, biometric data, browsing history, location data, or device fingerprints.

3. What We Store

After your scan finishes, we store exactly one thing: a payment token that lets you access your report for 30 days. Then it is gone.

AllScanTool stores the following data after a scan completes:

Data Element	Stored?	Location	Retention Period	Contains Code or PII?
Payment token	Yes	Cloudflare Workers KV	30 days, then auto-purged	No — token is a transaction artifact containing no source code or personal data
Unlock URL	Yes	Cloudflare Workers KV (tied to payment token)	30 days, then invalidated	No — URL contains a reference ID, not code or PII
Free scan mini-report	No	N/A — generated and displayed in-session only	Not persisted	N/A
Paid full report	No	N/A — generated fresh on demand via Unlock URL, not stored server-side	Accessible for 30 days via token; regenerated on each request, not persisted	N/A

The payment token stored in Cloudflare Workers KV is a transaction artifact. It contains no source code, no personal data, and no scan results. It exists solely to authenticate Unlock URL access for the 30-day period.

4. What We Do Not Store

We do not keep your code. We do not keep your scan results. We do not keep logs of what you scanned.

AllScanTool does not store, retain, or persist any of the following:

Source code: Submitted code is processed in memory during the scan and is not written to disk, database, cache, or any persistent storage layer controlled by AllScanTool
Scan results: Full vulnerability reports are generated fresh on demand via the Unlock URL but are not stored on AllScanTool-controlled servers
Request logs: AllScanTool does not maintain server-side logs of scan requests, code contents, or vulnerability findings
User identifiers: No accounts, no email collection, no user database
IP address logs: AllScanTool does not maintain access logs retaining user IP addresses beyond transient Cloudflare CDN processing
Telemetry or analytics: No behavioral tracking, session recording, or usage analytics tied to individual scans
AI model artifacts: No cached prompts, completions, or model responses stored by AllScanTool

AllScanTool does not retain source code after the scan completes. Code is transmitted to our AI/ML sub-processor for analysis and is not stored in any AllScanTool-controlled system.

5. Data Flow

Your code goes in, gets scanned by AI, results come back. Nothing is saved on our end.

The following describes the complete journey of your source code through our infrastructure:

1

User submits code via the AllScanTool web interface at allscantool.com

2

Code received by Cloudflare Worker — processed in memory only, not written to disk

3

Code transmitted via TLS 1.2+ to Mistral AI API at api.mistral.ai/v1/chat/completions (servers located in the European Union)

4

Mistral AI analyzes code for vulnerability patterns using AI/ML models. Under AllScanTool's paid API plan, code is NOT used for model training

5

Vulnerability findings returned to the Cloudflare Worker via TLS 1.2+

6

Report generated — free mini-report shown immediately; full report locked behind payment

7

Upon payment ($7.95 via Stripe) — payment token created and stored in Cloudflare Workers KV, unlocking full report access for 30 days

8

After 30 days — payment token auto-purged from KV storage. Unlock URL becomes invalid. No scan data remains in any AllScanTool-controlled system

At no point in this flow is source code written to persistent storage controlled by AllScanTool. The code exists in volatile memory (Cloudflare Worker execution context) only for the duration of the scan request.

6. AI/ML Sub-Processor (Mistral AI)

We use Mistral AI to scan your code. They keep it for 30 days for abuse monitoring, then delete it. They do not train models on your code.

AllScanTool transmits submitted source code to Mistral AI for AI/ML-assisted vulnerability detection. The following facts are confirmed:

Endpoint: api.mistral.ai/v1/chat/completions
Server location: European Union (GDPR jurisdiction)
DPA: A Data Processing Addendum is in place (legal.mistral.ai/terms/data-processing-addendum)
Plan type: Paid API plan

Under AllScanTool's paid API plan, submitted source code is NOT used to train, fine-tune, or improve any AI model — ours or Mistral AI's.

Mistral AI retains submitted code (inputs and outputs) for up to 30 rolling days for abuse monitoring purposes, then permanently deletes it.

Data is stored in the European Union by default, subject to GDPR.

Zero Data Retention (ZDR)

Mistral AI offers a Zero Data Retention (ZDR) option on its Scale plan. Under ZDR, request-level data is kept solely in volatile memory and purged within minutes of completion. AllScanTool may upgrade to a plan with ZDR if required. This policy will be updated to reflect any change in retention profile.

7. Cloud Infrastructure (Cloudflare Inc.)

Cloudflare runs our servers and stores your access token. They are a US company. The token has no code or personal data in it.

AllScanTool uses Cloudflare Inc. (United States) for the following infrastructure services:

Cloudflare Workers: Serverless execution environment that processes scan requests in memory
Workers KV: Key-value storage for payment tokens and Unlock URL references (30-day TTL)
CDN and DDoS Protection: Edge delivery and security filtering

The payment token stored in Cloudflare Workers KV contains no source code, no scan results, and no personally identifiable information. It is a transaction artifact that authenticates Unlock URL access.

Cloudflare's standard infrastructure may process request metadata (IP address, request headers) transiently for CDN routing and security purposes. AllScanTool does not control or configure Cloudflare's edge-level logging. For details on Cloudflare's data practices, see cloudflare.com/privacypolicy.

8. Payment Processing (Stripe Inc.)

Stripe handles your payment. We never see your card number.

All payment processing for the $7.95 full-report unlock is handled by Stripe Inc. (United States). AllScanTool does not store, process, or transmit full payment card details.

What Stripe handles: Card authentication, charge processing, fraud detection
What AllScanTool receives: A payment confirmation and a transaction reference used to generate the payment token
What AllScanTool does NOT receive: Card numbers, CVV codes, or full payment card data

For Stripe's data retention practices, see stripe.com/legal/privacy.

9. Retention Summary

Everything at a glance: what is stored, where, and for how long.

Data Type	Controller	Stored By AllScanTool?	Retention	Deleted How
Source code	AllScanTool → Mistral AI	No	Not persisted by AllScanTool	N/A — never written to disk
Source code (Mistral side)	Mistral AI	No (Mistral retains)	30 rolling days	Permanent deletion by Mistral
Scan results / vulnerability report	AllScanTool	No	Generated on demand via Unlock URL	N/A — not persisted server-side
Payment token	AllScanTool (via Cloudflare KV)	Yes	30 days	Auto-purged via KV TTL
Payment card data	Stripe Inc.	No	Per Stripe's policy	Per Stripe's policy
User accounts / profiles	N/A	No	N/A	N/A — no accounts exist
Email addresses	N/A	No	N/A	N/A — not collected

10. Sub-Processor Changes

If we switch AI providers or add new services, we will tell you 14 days before it happens — and update this policy first.

If AllScanTool adds a new sub-processor or replaces an existing one, we will post a notice at allscantool.com/sub-processors at least 14 days before the change takes effect.

Any change in sub-processor will require a corresponding update to all retention disclosures in this policy before the new sub-processor begins processing user data.

You may object to AllScanTool's appointment of a new sub-processor during the 14-day notice period by emailing privacy@allscantool.com. If you object, your sole remedy is to terminate use of the Service before the new sub-processor takes effect.

11. Verification and Audit

How do you know we are telling the truth? Check our infrastructure. The architecture speaks for itself.

AllScanTool's no-logs commitment is verifiable through the following architectural facts:

Cloudflare Workers execution model: Workers process requests in a stateless, memory-only environment. There is no persistent filesystem attached to a Worker execution. The 128MB memory cap per Worker execution prevents storage of large codebases even if attempted.
Cloudflare Workers KV TTL: Payment tokens are written to KV with a 30-day time-to-live (TTL). After 30 days, the KV entry is automatically purged by Cloudflare's infrastructure. AllScanTool does not manually delete tokens — the purge is automatic and guaranteed by the KV TTL mechanism.
No database: AllScanTool does not operate a relational database, document store, or object storage bucket. There is no backend database where scan data could be persisted even inadvertently.
Mistral AI DPA: Mistral's Data Processing Addendum (legal.mistral.ai/terms/data-processing-addendum) contractually governs the 30-day retention and deletion of code transmitted to their API.

For independent verification of Mistral AI's retention practices, see Mistral's Help Center.

12. Relationship to Other Policies

This policy is one piece of a larger set. Here is how it fits with the others.

This No-Logs Policy forms part of AllScanTool's legal framework and should be read alongside:

Privacy Policy — Covers personal data handling, GDPR/CCPA rights, data subject requests, and overall privacy commitments
Terms of Use — Governs use of the Service, including code submission licenses and AI processing disclosures
Acceptable Use Policy — Defines authorized and prohibited uses of the Service
Cookie Policy — Describes cookie and tracker usage
Sub-Processor List — Current list of third-party providers with change notifications

In the event of a conflict between this No-Logs Policy and the Privacy Policy, the Privacy Policy takes precedence for matters involving personal data rights. This No-Logs Policy takes precedence for matters involving scan data retention and code storage practices.

13. Contact Information

Lexicon Media Holdings LLC d/b/a AllScanTool
Privacy: privacy@allscantool.com
Legal: legal@allscantool.com
Mailing Address: 1209 Mountain Road PL NE #10912, Albuquerque, NM 87110, USA