# Where your code goes and what Kelrova keeps

Scans read only the code you link, in Kelrova Cloud. What Kelrova can see, what you can keep out, how access is limited and where the privacy policy applies.

*Where in the portal: Connections, Code Sources, Settings → Connected apps*

*Last updated: 2026-10-21*

Scans read your code in Kelrova Cloud, and only the code a member chose to link. Scans run in Kelrova's isolated cloud runtime, so there is nothing to install. This page covers what Kelrova can see and how you limit it. What Kelrova stores about you and for how long is in the [privacy policy](https://kelrova.com/legal/privacy).

## What Kelrova sees

- **Only what you link.** Kelrova sees only the repositories a member chooses to link on **Connections**. Owners and admins make that choice, and can change it later.
- **Only the part you point at.** A code source names one branch of a repository, and optionally one folder. The scan prepares the code from that branch and folder and nothing outside them.
- **Read, unless you ask.** Scans only read your code. Kelrova writes to a repository only when a member asks Go Fix to open a pull request, which is why a connection also asks for permission to open pull requests.

## What you can keep out

- **Excluded paths.** List folders such as `vendor/` or test fixtures on the code source. Excluded folders are not written into the scan's copy of the code. Up to 50 paths per source; see [Add a code source](https://kelrova.com/docs/getting-started/code-sources).
- **Large files.** Files larger than 8 MiB are left out of scans automatically. The run then reports the number of files skipped, and the scan is partial.
- **Files scans never review.** Directories and binary file types that scans skip as a rule are not written either.

Each run takes the excluded paths as they were when the run was created, so editing the list never changes a run that is already queued or running.

## How the code reaches a scan

Kelrova fetches the code of the tracked branch from your code host for each scan. Each source has a size limit, so a very large repository stops with a clear reason rather than running on. [Limits](https://kelrova.com/docs/reference/limits) lists the figures; the one to plan around is 1 GiB of source after exclusions.

## In transit

Your code and findings travel between your code host, Kelrova and your browser over TLS.

## Who sees findings

Access follows the project. Who sees findings depends on each project's visibility, Organization or Restricted, and on each member's permissions. See [Project visibility and project roles](https://kelrova.com/docs/organization/project-access).

A connected agent never sees more than the member who approved it. You can list and revoke each connection under **Settings → Connected apps**. [Connected apps and sessions](https://kelrova.com/docs/organization/connected-apps) describes the page.

## Revoking access

- Revoking an agent's connection, or removing a member, cuts off access on the next request.
- Removing a repository from a connection, or unlinking the connection, stops Kelrova reading it. On GitHub, the schedules that scanned it pause and are not resumed automatically.
- Unlinking a GitLab or Bitbucket connection also removes its stored credential.

## What you see in your account

A scan's confirmed findings are listed with their severity, location and evidence, and each finding's Activity records what happened to it. Removing a schedule stops future runs and keeps its instructions, threat model, history and findings.

## The privacy policy

How Kelrova handles personal data, including what it collects, who it shares it with, how long it keeps it and your rights, is in the [privacy policy](https://kelrova.com/legal/privacy). These pages do not restate it.

Questions about a specific setup go through [Getting help](https://kelrova.com/docs/reference/support).

## Related

- [Connect GitHub](https://kelrova.com/docs/getting-started/connect-github)
- [Add a code source](https://kelrova.com/docs/getting-started/code-sources)
- [Limits](https://kelrova.com/docs/reference/limits)
- [Connected apps and sessions](https://kelrova.com/docs/organization/connected-apps)