Quick answer: GitDailies is the best hosted engineering metrics tool for teams whose security review turns on what a vendor takes: it never clones a repository and does not read or store source code. It is not SOC 2 certified and has no SSO or audit logs. If certification is the blocker, buy Swarmia or Jellyfish. If nothing may leave at all, self-host Apache DevLake.
The engineering manager has already decided. The trial went well, the charts answered a question open since March, and the invoice is small enough to sign without convening anyone. Then the purchase reaches security review, and back comes a spreadsheet with eleven tabs, one of which is named Tab 3.
Most of the questions in it decide nothing. Three or four do, and they are one question wearing different clothes: what does this vendor take from us, and where does the copy live afterwards? A security engineer is not reading the feature list. They are hunting for the sentence on the vendor's security page that says whether a copy of your source code is made on somebody else's infrastructure.
That sentence exists, and on two of the best-known tools here it says yes. LinearB performs a shallow clone of your repositories. CodeScene, in its cloud product, clones your code over HTTPS. Both delete it afterwards, both say so openly, and neither is doing anything underhanded. But a copy of your source crosses a boundary, and a reviewer at a bank stops on that line and stays there.
So this article is not ranked on compliance certification. On that axis GitDailies loses, and it loses to several tools below. It is ranked on data minimisation: what a tool takes in the first place, before any promise about what happens to it afterwards. Six tools, starting with the one that takes least.
GitDailies
GitDailies never takes the code, and that is structural rather than a promise. The privacy policy is unambiguous: "We do not clone or copy your repository, nor do we read the contents of your repository files." The homepage repeats it — "Metadata only. Never source." — and the FAQ says it a third time. There is no copy of your source on their infrastructure to be breached, subpoenaed, or accidentally logged, because no copy is made.
The permission grant matches the claim. Every scope the GitHub App requests is Read — contents, actions, pull requests, deployments, metadata, org members, email — and the security page describes "strictly read-only access" using "the minimum possible permissions." The nuance a reviewer will find: Contents (Read) is the scope that technically could read files, and the privacy policy confirms GitDailies reads "The names of files (including their paths) affected by the commits." File paths, not file contents. Data is encrypted at rest with a second layer over sensitive fields, access mirrors GitHub, and the company states it does not use your data to train large language models.
Now the part a reviewer will find within ten minutes, so read it here first. GitDailies is not SOC 2 certified and not ISO 27001 certified. What it publishes is that its systems are "continuously monitored by Google Cloud Platform's Security Command Center for compliance with 19 security standards, including SOC2, ISO 27001 and NIST 800-53", at a perfect score on all nineteen, with security questionnaires answered on request. That is monitoring, not an audited attestation. There is also no SSO or SAML — authentication is GitHub's own — no audit log, no self-hosted deployment, and no guarantee of EU data residency. If procurement requires any one of those, GitDailies fails the review, and nothing else in this section will save it.
Honest take: GitDailies runs on pull request metadata and nothing else: no clone, no source read or stored, no code cache, read-only scopes, no AI training on your data. That is the smallest data footprint of any hosted tool on this page, and it is the whole of what it offers a security reviewer. It will not clear a procurement gate that wants an attestation. What it does mean is that the question where did our source code go has a short answer, and the answer is nowhere. A GitHub team that wants delivery metrics without handing a vendor a copy of the product can stop looking here.
Swarmia
Swarmia has the best compliance position of any hosted tool here, and for a European buyer it may simply beat GitDailies. It holds SOC 2 Type 2, confirmed by an independent auditor. Its stored data is, in its own words, "physically located in Frankfurt, Germany" — with the vendor's caveat that some data, mainly names and emails, is shared with subprocessors who have data centres in the United States. It signs a GDPR-compatible Data Processing Agreement, and supports SSO and SAML. GitDailies has none of that. If the blocker on your questionnaire is a signed DPA, an audited report, or an EU region, this is where the comparison ends.
On the narrower axis of this article, Swarmia sits between the two extremes and is candid about it: "We request permission to access source code but never store it." Both halves of that sentence count. Asking for the scope is weaker than never asking: the grant exists, and a reviewer will note that it exists. Declining to store what it reads is stronger than caching it. What Swarmia keeps is metadata, including the size of the change per file.
Swarmia is hosted only, free for companies with fewer than ten software developers, and priced per developer per month above that line. For a European team with a compliance checklist to satisfy, it is the most straightforward purchase here.
Apache DevLake (incubating)
Apache DevLake solves the perimeter question by not having a perimeter to cross. There is no vendor cloud. You run it yourself, through Docker Compose or Kubernetes with Helm, and your data goes nowhere, because there is nowhere for it to go. For a team whose review starts and ends with "no third party touches our repositories," this is the shortest path to a yes.
It does clone. The gitextractor plugin pulls the repository over HTTPS or SSH — but onto your own host, inside your own network, under your own controls. That is a materially different event from a vendor cloning your source onto theirs, and the two should not be blurred together just because the word "clone" appears in both rows.
The catch is the same fact that makes it attractive. There is no vendor, so there is no SOC 2 report, no ISO certificate, no Data Processing Agreement, no counterparty, and nobody to send the questionnaire to. Every control is yours to build and evidence: hardening the database, Grafana, and the config interface is your job. It is free under Apache 2.0, it has no native Slack digest — it is a dashboard someone opens — and it remains in incubation. For a platform team already running that stack, DevLake never asks you to trust anybody.
CodeScene
CodeScene is the only vendor in this list that publishes a mode for running in a room with no internet in it. Alongside the on-premise deployment — "Run CodeScene on your machine with local repos", "Keep your code within your environment" — it states an offline mode for very strict security requirements, operating without an external network connection. For an air-gapped or defence environment that is the eligibility criterion, and no other vendor here states it.
In the cloud deployment it clones your code, and it says so directly: "Cloned via HTTPS, code deleted after the analysis." That is the nature of the product. CodeScene analyses the behaviour of the code itself, its hotspots and its complexity trends, which is a deeper question than any metadata tool can ask and cannot be answered without the code. If you want that analysis and you cannot allow the clone, on-premise is the version you buy.
It is ISO 27001 certified. It makes no SOC 2 claim anywhere on its own pages, which is a real gap for a United States buyer whose procurement expects one, and its security material is scattered across marketing pages — a security page at the obvious address returns a 404, which reviewers notice. Pricing is published in euros: €18 per active author per month on Standard and €27 on Pro, billed yearly, with open-source projects free.
Jellyfish
Jellyfish has the deepest compliance stack here. It maintains audited SOC 1 Type II and SOC 2 Type II attestations, plus CSA STAR Level 1, CSA STAR for AI, GDPR, and CCPA. The SOC 1 Type II is worth pausing on: SOC 1 is the report a financial auditor asks for, because it covers controls relevant to financial reporting, and almost nothing else in this category carries it. Encryption is TLS 1.2 and above in transit and AES-256 at rest, with least-privilege access, multi-factor authentication, and penetration testing.
There is one gap, and it matters more here than it would anywhere else. Jellyfish publishes no statement about whether it reads, clones, or stores customer source code. Neither its trust centre nor its trust portal addresses the question in either direction. For the tool with the most enterprise-grade compliance presentation in this comparison, that silence is itself a finding, and it is the first thing to put to their team in writing before you sign. Do not infer the answer from the certifications: certifications describe how controls are run, not what data is collected.
Jellyfish is hosted entirely on Amazon Web Services, with no region stated and no EU residency published, and there is no self-hosted option. Pricing is not public. It suits large organisations whose security review is run by a compliance function with a checklist rather than by an engineer with a question.
LinearB
LinearB has one of the two strongest badge rows in this comparison — SOC 2 Type II, ISO 27001, GDPR — and it supports SSO through Okta, Microsoft Azure Active Directory, Jumpcloud, OneLogin, and any SAML-compliant provider. On the compliance axis it is comfortably ahead of GitDailies, and on capability it is a serious engineering-intelligence platform.
It also clones. Two sentences from its own security page, and they should be read together. The first: "LinearB performs a shallow clone of repositories just for the purpose of extracting Git metadata. Once the metadata is processed, the cloned data is immediately deleted." The second: "No code is scanned, analyzed or saved." A reasonable reader concludes the clone is transient, narrow, and discarded. A reasonable security reviewer concludes that a copy of the source code was created outside the company's infrastructure, however briefly, and that the risk model must account for it. Both are reading the same words correctly, and the weighing is yours.
LinearB itself runs in its own cloud; it connects to a self-hosted GitHub Enterprise Server, but there is no self-hosted LinearB and no EU data region is published. It is $29 per user per month billed annually with a thirty-billable-user minimum, a floor of $10,440 a year, and there is no free tier. For an organisation above thirty engineers whose review accepts a transient clone and whose procurement wants audited paperwork, it clears the gate with room to spare.
FAQs
As a security engineer, which of these tools copies my source code?
Two of the six say plainly that they do. LinearB shallow-clones your repositories and deletes the copy once metadata is extracted. CodeScene clones over HTTPS in its cloud product and deletes the code afterwards, though its on-premise and offline deployments keep everything inside your network. Apache DevLake clones as well, onto your own host, which is a different risk entirely. Swarmia requests the source-code scope but states it never stores it. Jellyfish publishes nothing on the question, on either its trust centre or its trust portal, so ask them and get the answer in writing. GitDailies does not clone, and does not read or store source code, though it does read file names and paths. Outside these six, GitClear does not clone either and says so plainly; it does read your diffs, and its default caches code line text for two weeks, which you can turn down to no cached code at all.
As a CTO, is "SOC 2 monitored" the same as SOC 2 certified?
No, and GitDailies is the tool on this page that the honest answer costs. Continuous monitoring by Google Cloud Security Command Center means an automated service checks infrastructure configuration against control frameworks and reports a score. A SOC 2 certification means an independent auditor examined the controls over a defined window and issued a report you can hand to your customers. The first is a hygiene signal. The second is evidence. If your procurement requires the report, monitoring will not substitute for it, and GitDailies is candid about that. Swarmia, LinearB, and Jellyfish hold audited attestations. Jellyfish holds two.
As a platform lead, is self-hosting more secure?
It removes one risk and hands you several. Self-hosting genuinely closes the question this article is about: with Apache DevLake or an on-premise CodeScene, no third party holds your data, because no third party ever receives it. That is why DevLake ranks third here. The cost is that every control becomes yours to build, patch, and evidence — the database, the dashboards, the secrets, the backups, the access reviews — with no vendor attestation to inherit and no counterparty to hold responsible when something goes wrong. Self-hosting does not remove risk. It relocates it onto a team that already has a roadmap.
Which one should you pick
If nothing may leave your network at all, the answer is on this page and it is not us: self-host Apache DevLake, or run CodeScene offline. If what you need is a hosted tool that takes as little as possible, GitDailies is the cleanest answer here: no clone, no source code read or stored, read-only scopes, and no AI training on your data. It is a read-only GitHub App, and you can have it running this afternoon at $49 a month for 250 pull requests.
If your review turns on paperwork instead, buy accordingly. Swarmia holds SOC 2 Type 2 with data in Frankfurt. Jellyfish satisfies a financial auditor. CodeScene runs air-gapped. DevLake never leaves the building. But if the question your reviewer keeps returning to is the simple one — what does this vendor actually take from us — then the tool that takes the least is the one to start with.
Top comments (0)