Security & data handling

Every organization is a tenant. Projects, artifacts, analyses, findings and reports carry the organization id, and PostgreSQL row-level security enforces that a request only ever sees rows of the signed-in organization. Stored files live under a per-organization, per-project path in object storage; download links are pre-signed and expire after at most 15 minutes.

You sign in with your password, with a single-use e-mail link (Send me a sign-in link on the sign-in page; the link expires after 15 minutes) or, where your organization configured it, with single sign-on. Organizations that enforce single sign-on block password and e-mail-link sign-in for their members. With two-factor authentication enabled, password and e-mail-link sign-in additionally ask for your authenticator or recovery code. Single sign-on does not show this prompt: the session is issued once your identity provider has confirmed the sign-in, so configure multi-factor authentication for SSO at your identity provider. See SSO & SCIM.

In the browser the session exists only as an HTTP-only cookie that page scripts cannot read; no session token is kept in browser storage. Changing requests additionally carry an anti-forgery token and are only accepted from the ERP Preflight web origin. Signing out ends the session on the server. Active sessions are listed, and can be ended individually or all at once, under Settings → Security.

Uploads are type-checked by content, archive-checked (ratio, size, nesting, path traversal) and malware-scanned before an engine can read them. Text formats (XML, XSD, WSDL, EDMX, XDP, JSON, CSV, ABAP and plain-text sources) are also secret-redacted before they are stored; ZIP and PDF files are stored as uploaded, and the analysis service redacts every evidence snippet before a finding leaves the service. Files that fail a check are marked QUARANTINED or REJECTED and are never analysed. Details: Data handling in detail.

The analysis service is stateless: it receives the artifacts of one run, parses them with hardened parsers, evaluates the rules and returns findings. It has no access to the user, billing or tenant tables.

Organization owners and security admins set retention periods for artifacts and reports in Settings → Data & reports; expired data is deleted by a background job, hourly by default. Account holders can export their personal data and delete their account in Settings → Account & privacy. Security-relevant actions (sign-ins, API key changes, exports, member changes) are written to the audit log under Settings → Audit log.

The free tools and the public SAP object pages read only global, reviewed knowledge (official SAP release data and reviewed articles). They never read workspace data. The XML field checker parses the pasted document in memory and stores nothing.

See the security overview, the Trust Center and the list of subprocessors.