Security & Zero Trust
Have your software valued without exposing your source code.
Codeego performs code analysis inside confidential computing environments, issues a signed valuation report under international standards, and preserves the underlying intellectual property under qualified custody. No human read access, no model training, no third-party reuse.
The question that brings you here
How can a software valuation happen without exposing your source code?
Codeego analyses source code inside hardware-backed Trusted Execution Environments, operated by Chutes within Google Cloud in the EU. IAM controls technically prevent any Codeego operator from reading client code in clear.
When the assessment completes, the source code is deleted within hours. The valuation report is signed by an accredited valuer under eIDAS, and optionally sealed under qualified custody. Every step is logged in a tamper-evident chain of custody.
Encrypted source code
Uploaded over TLS 1.3 into an isolated EU workspace.
Sealed TEE enclave
Analysis runs inside an attested enclave. No operator reads code in clear.
Signed valuation report
Issued under eIDAS. Working copy deleted within hours, custody optional.
Ready to evaluate Codeego for your next engagement?
Request the full security whitepaper for distribution within your security, legal and procurement teams.
On submit, the whitepaper opens in a new tab and a copy is sent to your email.
What Codeego never does.
No production access
Codeego does not access production systems, customer databases, runtime environments or live workloads. Source code is processed exclusively for the contracted assessment.
No runtime access
Code is not executed outside the contracted analysis. No interaction with CI/CD pipelines, internal services, logs or telemetry from client environments.
No model training on client code
Source code, valuation reports and derived artefacts are never used to train AI models, in Codeego or elsewhere.
No third-party reuse
Client data is not shared, resold or repurposed beyond the closed list of subprocessors disclosed in the security whitepaper. Material changes to the subprocessor list are notified to clients in advance.
No retention beyond agreed windows
Source code is deleted from working storage as soon as the assessment completes. Reports and derived artefacts are retained for 5 years by default, adjustable on request.
How the analysis works.
Every step is logged to an immutable chain of custody and verifiable on request.
- 01/05
Encrypted upload
Client uploads source code over TLS 1.3.
- 02/05
Bounded ingestion
Code stored in an EU GCS bucket. IAM blocks human read access.
- 03/05
Confidential LLM analysis
LLM analysis runs inside Chutes TEE with attestation.
- 04/05
Signed report
Report signed by an accredited valuer (PAdES, eIDAS) via TrustCloud.
- 05/05
Secure deletion
Source code is deleted from working storage as soon as the assessment completes. The deletion is captured in the audit trail.
Optional · IP Custody add-on
Sealed under qualified custody
Included with Pro by default, and selectable on Expert and Enterprise engagements. When enabled, reports and supporting evidence are sealed in the TrustCloud qualified vault with post-quantum encryption at rest, instead of being deleted. See the data handling section for retention details.
Built on certified infrastructure and qualified providers.
Codeego does not hold security certifications in its own right. Each layer of the service is delivered through providers with audited credentials. The trustworthiness of Codeego is the trustworthiness of the certified providers it operates on, combined with the controls Codeego applies on top of them.
| Layer | Provider | Audited credentials |
|---|---|---|
| Cloud hosting | Google Cloud Platform (region europe-west1, Belgium) | ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, PCI DSS Level 1. Provider compliance portal |
| Confidential computing | Chutes (chutes.ai) | TEE attestation framework operated by Chutes. Verification artefacts available to clients on request. |
| Qualified IP custody | TrustCloud | eIDAS-qualified, listed on the EU Trusted List. EU Trusted List browser |
Layer
Cloud hosting
Provider
Google Cloud Platform (region europe-west1, Belgium)
Audited credentials
ISO 27001, ISO 27017, ISO 27018, SOC 1/2/3, PCI DSS Level 1. Provider compliance portal
Layer
Confidential computing
Provider
Chutes (chutes.ai)
Audited credentials
TEE attestation framework operated by Chutes. Verification artefacts available to clients on request.
Layer
Qualified IP custody
Provider
TrustCloud
Audited credentials
eIDAS-qualified, listed on the EU Trusted List. EU Trusted List browser
Technical details.
For security, infrastructure and architecture teams. The full document is available in the security whitepaper.
The LLM analysis step of every assessment runs inside hardware-backed Trusted Execution Environments operated by Chutes. Static measurement and orchestration run on Google Cloud Run. TEE attestation is provided by Chutes and made available to clients on request during engagement onboarding. Verification artefacts are issued at the start of Expert-tier engagements.
Uploaded source code lands in a Google Cloud Storage bucket whose object-level access is granted exclusively to the analysis-service service account. No Codeego operator account is bound to this role in production. Reading client code in clear is technically blocked by GCS IAM and audited through Google Cloud Audit Logs (Admin Activity and Data Access logs).
TLS 1.3 with cipher suites negotiated by the Google Cloud HTTPS frontend (ECDHE with AES-256-GCM or ChaCha20-Poly1305). Post-quantum hybrid key exchange is not enabled at the TLS layer; PQC is applied at the qualified custody layer.
AES-256 with Google-managed encryption keys on Cloud Storage and Cloud SQL, with automatic key rotation. Application secrets are held in Google Cloud Secret Manager with versioned rotation. Customer-managed keys (CMEK) are available on request for Expert-tier engagements.
Post-quantum algorithms are applied by TrustCloud at the qualified custody layer to seal valuation reports and supporting evidence bundles for long-term preservation. Specific algorithms in use are documented in TrustCloud's QTSP technical specification, available on request.
Valuation reports are cryptographically signed by an accredited valuer using PAdES qualified electronic signature under eIDAS, issued through TrustCloud as a Qualified Trust Service Provider.
Every operation performed on a client's source code or derived artefacts is recorded in a tamper-evident log: timestamp, operation type, actor, scope, attestation reference and cryptographic hash of the affected artefact. The log is retained for 5 years. Clients can reclaim the log at any time during this period through Codeego support.
Data handling and retention.
| Data category | Retention and treatment |
|---|---|
| Source code submitted for analysis | Deleted from working storage as soon as the assessment completes (typically within hours of report delivery). The deletion event is captured in the audit trail and confirmed to the client. |
| Valuation reports and supporting evidence | Retained for 5 years by default in Google Cloud Storage (europe-west1, Belgium). For Pro and Expert engagements, sealed in the TrustCloud qualified preservation vault. Retention may be adjusted on request. |
| Chain-of-custody log | Retained for 5 years. Reclaimable at any time through Codeego support. |
| Data location | All data stored in the EU (Belgium, europe-west1). For clients outside the EU/EEA, cross-border transfers are governed by EU Standard Contractual Clauses, Module 2 (Controller to Processor) under Commission Implementing Decision (EU) 2021/914. |
Source code submitted for analysis
Deleted from working storage as soon as the assessment completes (typically within hours of report delivery). The deletion event is captured in the audit trail and confirmed to the client.
Valuation reports and supporting evidence
Retained for 5 years by default in Google Cloud Storage (europe-west1, Belgium). For Pro and Expert engagements, sealed in the TrustCloud qualified preservation vault. Retention may be adjusted on request.
Chain-of-custody log
Retained for 5 years. Reclaimable at any time through Codeego support.
Data location
All data stored in the EU (Belgium, europe-west1). For clients outside the EU/EEA, cross-border transfers are governed by EU Standard Contractual Clauses, Module 2 (Controller to Processor) under Commission Implementing Decision (EU) 2021/914.
Frequently asked questions.
No Codeego operator account is granted standing read access to uploaded source code. Access is granted exclusively to the analysis-service service account, with all credential usage captured in Google Cloud Audit Logs. The architecture is described in detail in the security whitepaper.
Source code is deleted from working storage as soon as the assessment completes, typically within hours of report delivery. The deletion event is captured in the audit trail and confirmed to the client. Derived artefacts (the report itself, supporting evidence) are retained under the terms described in the data handling section.
No. Client source code, valuation reports and any derived artefacts are never used to train AI models, in Codeego or elsewhere.
Codeego does not hold security certifications in its own right. The service runs on certified providers: Google Cloud (ISO 27001, SOC 2, ISO 27017, ISO 27018), Chutes for TEE-backed confidential computing, and TrustCloud as a Qualified Trust Service Provider listed on the EU Trusted List. The combined assurance is documented in the security whitepaper.
Valuation reports are signed with a PAdES qualified electronic signature under eIDAS, issued through TrustCloud as a Qualified Trust Service Provider. This makes the report legally equivalent to a handwritten signature across the European Union under Regulation (EU) 910/2014.
Yes. TEE attestation is provided by Chutes and made available to clients on request during engagement onboarding. Verification artefacts are issued at the start of Expert-tier engagements.
All data is stored in the EU (Google Cloud, region europe-west1, Belgium). For clients outside the EU/EEA, cross-border transfers are governed by EU Standard Contractual Clauses, Module 2, under Commission Implementing Decision (EU) 2021/914.
Yes. The report is signed by an accredited valuer with a qualified electronic signature under eIDAS, aligned with International Valuation Standards. It is designed to be used as evidence in due diligence, M&A processes, financing rounds and regulatory filings.
Still have questions?
Talk to our security team and we will walk you through the architecture, attestation and custody model.
Talk to sales