Connect a project
Available means supported by the product, not necessarily connected to an engagement. For a project source, choose Connect to open an engagement's Sources section. Editor connections use your account settings. Read only, the least it can. Open a tile for the exact list.
Code
Install the app on chosen repositories. Contents, read only.
ConnectWhat it reads
Each scan clones at a fixed commit and reads the code for data flows, vendors and policy text. Redacted excerpts go to the evidence store; the clone stays on this server, unredacted, until the retention period ends or you delete the engagement. Revoke in GitHub at any time. Install the app.
dependency manifests, code patterns (secrets, personal-data fields, logging, AI and analytics SDKs, vendors, auth, deletion and consent handling); excerpts only, never whole files.
A read only clone from GitLab.
A read only clone from Bitbucket.
Hosting
A token, used once for read requests. Domains, region and variable names; values discarded.
ConnectWhat it reads
The configured domains, the configured function region, the names of the environment variables with their environments, the linked repository, framework and Node version, access protection settings, cron count, and the latest production deployment's state and date. Decrypted values are never requested; plain text values the listing carries are discarded before storage, and no value appears in any record. Vercel cannot limit a token to read only, so create one for this team with a short expiry and delete it after the snapshot. This server only makes read requests, sends the token only to api.vercel.com, and does not store or log it. Each scan replays the snapshot with its date; you refresh it when you choose.
What this gives you: the configured function region as a country, checked against the DIFC adequacy list; the configured domains; which vendors a key name suggests, even before a repository is connected. A key name suggests a vendor; it does not prove that personal data reaches it, and the records say so.
The same reads from a Cloudflare project.
The same reads from a Netlify site.
The same reads from a Railway project.
Your editor
Read your engagements, findings and records from the editor over MCP.
ConnectHow to connect
Read only: no tool on the server writes.
claude mcp add --transport http dembri-privacy-records https://privacy.dembri.com/mcp --header "Authorization: Bearer <your token>"
Uses our live read only MCP server. Client connection not tested.
How to connect
Add an MCP server of type http at https://privacy.dembri.com/mcp with the header Authorization: Bearer <your token>. Read only.
Uses our live read only MCP server. Client connection not tested.
How to connect
Add an MCP server of type http at https://privacy.dembri.com/mcp with the header Authorization: Bearer <your token>. Read only.
Scan your code on your machine from the editor; only redacted evidence comes to the server.
No code and AI builders
Builders are listed by the route that works today, a synced GitHub repository; the scanner reads what the generated code calls. We have not tested each builder's output.
Also live
Public pages only, up to the page cap.
ConnectWhat it reads
Public pages only. No login, no form submission. Public addresses only.
pages, HTTP headers, cookies set before consent, third-party scripts, forms, robots, sitemap, security.txt, llms.txt.
One specification file; no request to the API.
ConnectWhat it reads
security schemes, endpoints that carry personal data, anonymous endpoints, bulk and upload and delete operations.
Allow listed read only tools, with a budget.
ConnectWhat it reads
Only servers the administrator declared, only allowlisted tools that the server marks read-only, with a call budget and a timeout. Results are redacted structurally before storage.
Policies, agreements, records you upload.
ConnectWhat it reads
Files you upload: policies, DPAs, ROPA, previous DPIA, architecture notes. Parsed in an isolated process.
redacted extracted text, classified by document type.
Need another connector? Say which, through the request form. Retention and model vendors in force: data handling.
Names and marks belong to their owners. They show which tools connect, not an endorsement.