Everything needed to run code security as a process, not a project
One system of record from the first inventory scan to the last verified fix, for every role involved. Run it where your security policy says it should live.
Frontier models, open-weight models or fully local. Your code policy decides.
Every scan level above the inventory is read by a language model. You choose which models, and where they run, per project. The workflow, verdicts and reports stay identical.
Connect an account, browse organizations and repositories, import in bulk and start scanning in minutes. Sync keeps the working copy current with the branch you choose.
Scan levels with estimates
From a quick inventory to a full advanced review. Each level shows its estimated scope and cost before you commit, so depth is a business decision, not a surprise.
Expert analysis console
Analysts work in a Claude-powered console that reads files, searches code and finds definitions across the repository. Notes and evidence save directly to the finding.
Verdicts and re-checks
Every reported line gets a human verdict. Fixed locations are re-checked against current code, and retracted ones stay on record so noise never comes back.
Reports and audit trail
Generate PDF findings reports, email them to stakeholders, and rely on a complete history of who changed what on every finding.
Multi-tenant with fine-grained permissions
Separate companies, projects and users. Presets from read-only to company admin, plus per-action permissions, so partners and clients each see only their own work.
Level 1
Quick inventory
Files, languages, structure. No AI. Seconds.
Level 2
Targeted
Deep analysis of the focus areas you define.
Level 3
Medium
Broad coverage of code files with contextual analysis.
Level 4
Full
Every code file, cross-file dedup, prioritized findings.
Level 5
Advanced
Maximum depth, sharded across parallel workers for large codebases.
Three ways to run it
The same platform, at the level of isolation your policy requires
Every option runs the identical workflow, scan levels and reports. What changes is who operates it and where your code lives. Start wherever fits today; your history moves with you if you change later.
Start today
Our shared cloud
Best for: Teams that want to see results this week without involving IT.
SourceScan.ai runs as a multi-tenant service. Your company gets its own workspace with its own users, projects, findings and permission presets. Repositories are cloned into storage that belongs to your tenant, and AI analysis runs with the Anthropic credentials you hold, so no tenant can spend another's budget.
What you get
Nothing to install. Connect GitHub and run the first inventory scan in the same session.
Company-level isolation: users, projects, findings, annotations and reports are scoped to your tenant.
Your own AI credentials, managed in Settings, used only for your projects.
Automatic updates. New scan levels, workflow and reporting features arrive as we ship them.
Permission presets from read-only to company admin for clients, partners and auditors.
Best for: Organizations that need hard isolation from other customers but do not want to operate servers.
We provision a dedicated instance for you: your own application and database containers, your own hostname and certificate, your own storage for cloned repositories and attachments. No other customer shares the database, the process or the disk. It is the same platform, so the workflow, scan levels and reports are identical.
What you get
Dedicated application and MongoDB containers, provisioned and monitored by us.
Your hostname, for example yourcompany.sourcescan.ai or a domain you own, with TLS handled for you.
Separate backups and retention you can specify.
Upgrade windows you approve, so a release never lands during your audit or launch week.
Optional network restrictions such as allow-listing your office and CI ranges.
Best for: Regulated environments, government and healthcare work, and any codebase that is not allowed to leave the building.
The same Docker stack deployed on your servers, virtual machines or private cloud, behind your firewall. Repositories, findings, analysis notes and reports never leave your network. You connect your own GitHub or GitHub Enterprise, hold your own AI credentials and run backups under your existing policies. We supply the images, the compose definitions and a runbook, and we support your team through rollout and upgrades.
What you get
Full data residency. Source code and findings stay inside your network boundary.
Works with your identity, logging and network controls; the app sits behind your reverse proxy.
Your GitHub or GitHub Enterprise connection and your Anthropic credentials or enterprise gateway.
Versioned releases you pull on your schedule, with release notes and a tested upgrade path.
Support from our team and, if you want it, our partner analysts working inside your instance.
Isolation
Your servers, your network
Where code lives
Never leaves your infrastructure
Who operates it
Your team, with our support and runbook
Time to first scan
Your schedule, typically about a week
AI analysis needs outbound access to the Anthropic API, directly or through your enterprise gateway. Everything else runs offline.
Projects, findings, verdicts, line annotations and analysis notes export as a single portable bundle that imports into another instance with every cross-reference intact. Prove the value in the shared cloud, then move to a dedicated or self-hosted deployment when procurement catches up.
Three ways to run the AI
Choose the models, and where they run, to match your data policy
The scanning workflow, verdicts and reports are the same whichever models do the reading. What changes is the capability ceiling, the cost model and, above all, where your source code is allowed to go.
Highest capability, fastest start
Cloud-based frontier models
Best for: Teams that want the strongest analysis quality available and whose policy allows code to be sent to a model provider under its enterprise terms.
Analysis runs against hosted frontier models through their APIs: Anthropic Claude, OpenAI ChatGPT and xAI Grok. Credentials are yours and are held per company, so each tenant pays its own provider directly and no one can spend another's budget. Claude is the default and most tested path; the others are available per engagement.
What you get
Your own API keys, stored per company and used only for your projects.
The best reasoning over large, tangled codebases: cross-file data flow, call paths and intent.
Enterprise and zero-retention terms from the provider where offered.
Scan concurrency scales with your API tier; every scan shows its estimated cost before it runs.
Switch providers per project without changing the workflow, findings or reports.
Where inference runs
The model provider's cloud
What leaves your environment
Relevant files and snippets, per request, under the provider's terms
Best for: Organizations that cannot send source code to an AI vendor but do not want to buy and operate GPUs.
We run open-weight models such as Kimi, DeepSeek, Qwen and Llama on GPU hardware reserved for you. Prompts, code and outputs stay inside the SourceScan.ai platform and never reach an outside model provider. Pair it with a dedicated Docker deployment for a fully single-tenant stack, and choose the model per project.
What you get
Dedicated GPU capacity, sized for your codebases and scan cadence.
Choice of model per project, with newer open-weight releases added as they prove out.
No per-token vendor billing: reserved capacity at a flat rate.
Prompts and outputs retained only within your tenant, on your retention terms.
Same scan levels, verdicts, reports and audit trail as every other option.
Where inference runs
GPU servers we reserve for you
What leaves your environment
Code reaches the SourceScan.ai platform only, no AI vendor
Best for: Air-gapped and highly regulated environments, and any self-hosted deployment that must keep every byte on premises.
Models run on hardware inside your network: your existing GPUs, or GPU servers we specify, supply and install on your premises and maintain under contract. Combined with the self-hosted platform deployment, nothing leaves the building: not the code, not the prompts, not the findings. This is the only option that works with no outbound internet access at all.
What you get
Air-gap capable: analysis runs with no connection to any cloud service.
Hardware sizing and model selection guidance for your codebase volume.
We can supply, install and maintain the GPU servers, or you bring your own.
Model updates and platform upgrades applied on your schedule, from media you control.
Our partner analysts can work inside your instance under your access rules.
Files and snippets per request, under provider terms
Code reaches our platform only
Nothing
Analysis quality
Highest available
Strong, improving with each release
Strong, bounded by your hardware
Cost model
Per token, your provider account
Flat reserved capacity
Hardware plus support
Setup
Minutes
Days
Weeks
Works offline
No
No
Yes
Pairs best with
Shared cloud or dedicated Docker
Dedicated Docker
On your infrastructure
Mix them by project and by scan level
The quick inventory scan uses no model at all. Beyond that, each project can use the model option its data policy allows, and the deeper scan levels can use a stronger model than the broad ones. A frontier model for the advanced review of your payment module and an open-weight model for the medium scan of everything else is a normal configuration, not a special case.
Compliance ready
Reports aligned with the standards your auditors ask about
Findings are categorized and reported in language that maps to the frameworks security and compliance teams already use, so a SourceScan.ai report supports the evidence you need rather than creating another translation exercise.
OWASP Top 10CWESANS Top 25Severity and risk scoreVerification statusRemediation history
Useful for HIPAA, SOC 2, PCI DSS and customer security questionnaires that require evidence of secure development practices and tracked remediation.
Experts and developers working together
Built for the three people who have to agree before a vulnerability is actually fixed
Most security tools stop at the alert. SourceScan.ai is the shared system of record that carries each finding from discovery to a closed, verified fix.
Decision makers
CTOs, CISOs, product owners, compliance leads
Risk posture per project at a glance: open, in remediation, verified and closed
Remediation progress bars and history that show the trend, not just today's count
PDF reports you can hand to auditors, customers or the board
Cost and scope estimates before you approve a deeper scan
Company-level permissions so every stakeholder sees exactly what they should
Programmers
Developers, tech leads, contractors
Findings pinned to the exact file and line, with the code snippet and a recommended fix
Files that appear in several findings are flagged so one fix closes many issues
Validation questions from the security team arrive in the dashboard, not in a hallway
Mark a location fixed and re-check it against the current code
Assigned work, clear status, no spreadsheet
Security experts
In-house analysts or our partner cybersecurity team
AI analysis console with file reading, code search and definition lookup across the whole repository
Sharded scan engine covers large codebases in parallel at the depth you choose
Record a verdict on every reported line: confirmed, retracted or not a finding
Attach full analysis notes, attack scenarios and evidence to each finding
Ask programmers targeted questions when a result depends on how the code is used
Deeper than a pen test
Ready to see what's really in your code?
Bring one repository. We will show you the inventory, a first scan and the workflow that turns findings into closed, verified fixes.