Review third-party software
before you approve it.

CIRT applies a consistent framework and links findings to submitted evidence where available, but it does not guarantee complete or error-free detection. AI outputs can include false positives, false negatives, and misinterpretations. A qualified human should review material findings and make the final decision.

Uncertainty, missing documents, incomplete controls, and unanswered questions are treated as gaps to resolve. Missing evidence is not silently converted into a positive control conclusion.

Most reviews complete within a few minutes. Code reviews use Anthropic batch processing, which can technically take up to 24 hours. For this workload, batch processing is normally faster and cheaper than comparable synchronous Anthropic calls, but completion time is not guaranteed.

You may upload material you are authorized to submit. Direct private-repository connections are not currently supported; repository scanning is designed primarily for open-source software. Authorized source can be provided as a ZIP. Review the Security & Trust page and your confidentiality obligations before submission.

Code files are discarded after processing. Cryptographic file hashes and underlying file-level assessment results from code reviews are retained indefinitely by default, including after the code review assessment itself is deleted. For a sensitive codebase, an option available during the initial scan can delete the stored hashes and file-level results created for unique files first seen in that repository after report generation. This option is generally not recommended because it reduces retained analysis history and reuse. A file-level result is primarily a generated summary of the file's purpose and its associated security findings; in rare circumstances it may include a small code snippet. It cannot identify or reconstruct the submitted source file. Vendor documents are retained by default for documentation continuity, but retention can be disabled. The vendor assessment and its retained documents can be deleted at any time.

No for all-inclusive plans. For Bring your own key, processing follows your Anthropic account and contract settings. If AI model training is enabled for that account, your Anthropic terms control that use.

Yes. Reports can be shared by link through the web application or exported in HTML and PDF formats. They are designed to support internal approvals and conversations with auditors, clients, and stakeholders. Professional and Scale plans add co-branded or white-label options.

Vendor reviews support custom risk requirements and deal-breakers. Code reviews currently use the standard risk configuration and do not support customization.

Integrations are limited to those built against the open API. SSO is available as a $75/month add-on.

Early-access code assessments have averaged less than $2 in Anthropic usage, and vendor assessments are usually lower depending on document count. Actual cost varies with file count, code volume, model usage, and your Anthropic terms. Bring your own key primarily provides cost control; it does not remove CIRT infrastructure or report processing.

The report documents what was supplied, identifies missing evidence and unanswered questions, and helps structure follow-up. It does not treat an absent SOC 2 report or unsupported claim as proof that a control exists.

No. CIRT organizes evidence and provides decision support. Your organization retains responsibility for validating findings, applying business context, and making the final approval decision.

General-purpose AI can summarize a security document or inspect source code. CIRT adds a repeatable review process around that analysis: consistent requirements and scoring, evidence-linked findings, explicit treatment of missing evidence and uncertainty, retained assessment history, deployment decisions, shareable reports, and scheduled rescans. Scale adds multi-client workflows. Bring your own key lets you use your own Anthropic account while retaining CIRT's review framework, workflow, reporting, and audit record.

Those platforms can manage questionnaires, evidence collection, and vendor-risk workflow. Compare CIRT with Vanta or Whistic. CIRT reads the evidence you submit, identifies controls and gaps, and produces a deployment-focused decision report. The tools can complement each other.

Snyk and Dependabot focus on vulnerabilities in code your team develops and ships. CIRT evaluates whether someone else's software or service should be approved to run in your environment.

If an assessment fails for a reason attributable to CIRT, its assessment allowance is restored automatically. Large repositories use the published lines-of-code surcharge schedule. Failures caused by invalid Bring your own key credentials, insufficient Anthropic credit, unsupported customer input, or third-party outages outside CIRT's control do not receive that representation. Platform-access and refund issues follow the Refund Policy.