Trust
Last updated: July 23, 2026
What this page is
Nark is early-stage. This page is a candid snapshot of what we run, what we hold, and what compliance work is in flight. It is written for the CTOs and security engineers of prospective design partners, and for their auditors. If you spot something missing or unclear, email security@nark.sh.
Compliance status
Nark is not yet SOC 2 attested. We are pre-audit. What we have today:
- All infrastructure runs in single-tenant SaaS providers with SOC 2 Type II attestation of their own (see the subprocessor list below).
- Access controls are enforced by Clerk and by GitHub organization roles. All human access to production requires MFA.
- Data in transit is TLS 1.3. Data at rest is AES-256 through our subprocessors.
- Source code is version-controlled on GitHub with branch protection on main.
Planned: Vanta or Drata onboarding follows first paid design partner. Type I attestation after 3 months of continuous evidence collection. Type II after 12 months. See our SOC 2 primer for the compliance path we are on and how Nark itself functions as CC7.1 and CC8.1 evidence in your own SOC 2 program.
Subprocessor list
Third-party services Nark uses to deliver the product. Adding a new subprocessor requires an update to this page and a 30-day notice to design partners with an active contract, per our standard MSA.
| Vendor | Service | Purpose | Region | Data types |
|---|---|---|---|---|
| Vercel Inc. | Web hosting (nark.sh, app.nark.sh) | Static site hosting, serverless function execution, edge network | United States (multi-region) | Request metadata, HTTP logs |
| Clerk Inc. | Authentication | User sign-in, session management, organization membership | United States | Email, name, OAuth identity, session tokens |
| DigitalOcean, LLC | Managed PostgreSQL database | Primary application data storage | United States (New York) | User accounts, scan telemetry, organization records |
| Inngest Inc. | Background job queue | Async scan orchestration, webhook fan-out | United States | Job payloads (repo URLs, scan config), execution logs |
| Stripe Inc. | Payments and billing | Subscription checkout, invoicing, tax handling | United States | Billing contact, payment method (tokenized by Stripe, we never see card numbers) |
| Resend Inc. | Transactional email | Sign-up confirmations, scan-complete notifications, receipts | United States | Recipient email, message body |
| Sentry Software, Inc. | Error monitoring | Application crash reporting for the web app and CLI | United States | Scrubbed stack traces (PII removed before send) |
| PostHog Inc. | Product analytics | Feature usage, funnel measurement (opt-out available) | United States | Anonymized event stream, no page content |
| Anthropic PBC | Claude API | Corpus quality labeling (double-blind), never scans your code | United States | Public npm package docs, corpus YAML profiles (never customer code) |
| GitHub, Inc. | Source control, GitHub App, GitHub Packages | Repo hosting for OSS scanner, private corpus distribution, PR-check integration | United States | For design partners with the GitHub App: PR metadata, code diff snapshots |
| DigitalOcean, LLC | Spaces object storage (S3-compatible) | Scan artifact storage (audit JSON, diff snapshots) | United States (New York) | Scan output artifacts, audit records |
| Upstash, Inc. | Serverless Redis | API rate limiting | United States | IP address and request metadata (rate-limit counters only) |
Every listed vendor has SOC 2 Type II attestation. Subprocessor changes are logged in git; the change history for this file is public in the marketing site repo.
What data we hold
- Account data: email address, name (optional), GitHub identity (via Clerk OAuth). Retained until account deletion, then purged within 30 days.
- Scan telemetry: anonymous scan metadata (package names, violation counts, scan duration, Node version, OS). See our telemetry page. Retained indefinitely as aggregate data.
- Design-partner scan artifacts (opt-in): for partners who install the GitHub App, we retain PR-level scan output for the duration of the engagement plus 90 days.
- Billing records: for paid customers, held by Stripe. We do not store card numbers or bank details at any time.
What data we do not hold
Nark analyzes your TypeScript source code locally, in the developer environment or in your CI runner. The scanner reads code, produces violations, and reports counts. Source code, file paths, function names, and variable names never leave your machine.
The one exception: design partners who explicitly opt into the GitHub App integration grant us read access to their PR diffs so the app can post inline comments. This is scoped by GitHub App permissions and revocable by the org admin at any time.
Access and security
- Founder-only production access. No employees at this stage.
- Hardware-key MFA on all production accounts (GitHub, Vercel, Clerk, Stripe, DigitalOcean, Sentry).
- Password manager: 1Password. No plaintext credentials in git, ever.
- Secret rotation: quarterly for API keys we control. Immediate on any suspected exposure.
- Backups: managed by each subprocessor. DigitalOcean Managed Databases run automated daily backups with point-in-time recovery.
Vulnerability reporting
Report security issues to security@nark.sh. We aim to acknowledge within 2 business days and to disclose a fix or workaround timeline within 10 business days.
Nark's own scanner is open source at github.com/nark-sh/nark (AGPL-3.0). Please file scanner bugs and security issues in the public issue tracker unless the issue could be exploited against other users, in which case use the email above.
Requesting more
Design partners with a signed contract can request our current security questionnaire responses (SIG Lite, CAIQ) and any relevant subprocessor DPAs. Prospects can request the same after signing a mutual NDA. Email security@nark.sh.