Public packages, installed extensions, imported reports, and team workspaces do not follow the same data path. GuardRails keeps those differences explicit.
“Private” describes an access boundary, not a claim that no operational data exists. Each path below states what is received, retained, and controlled.
Public intelligence
Published extensions
What is received
Registry metadata and the exact published package selected for analysis.
What is retained
Versions, hashes, normalized findings, dependencies, file inventory, coverage, and scanner identity may remain publicly available.
Your control
Public reports can be shared without an account.
Local workflow
Installed extensions
What is received
The GuardRails website does not enumerate extensions installed on your computer.
What is retained
Local CLI analysis stays on the machine unless you explicitly export or import a portable report.
Your control
You choose when a report leaves the local workflow.
Browser storage
Imported report bundles
What is received
A report.zip selected or dropped into the Analyze or Reports page.
What is retained
The parsed report is stored in this browser, not uploaded by the report importer.
Your control
Remove individual reports from the local report library.
Operational history is retained for workspace review and audit. Sensitive channel targets are encrypted and excluded from exports.
Your control
Workspace roles govern access to team data and audit exports.
Deletion and export
Local reports stay under your control.
Imported report bundles can be removed from the Reports library. Account and workspace export or deletion requests require identity verification so one member cannot erase another team’s operational record.
