Enterprise evaluation

Prepare the security review.

Deployment diagrams, data handling, retention, and 20 security answers in one downloadable pack.

Download procurement PDF Trust Center

Version 1.0 · Reviewed October 4, 2026 · No form required

Preview the PDF ↗

Inside the pack

Deployment and data flow

Conceptual responsibility and provider boundaries.

Retention by category

Working copies, artifacts, resume data, records, backups, and model providers.

Security questionnaire

20 concise answers with evidence status and references.

Procurement checklist

Documents and decisions to agree before access and rollout.

Public materials and selected implementation paths were reviewed on October 4, 2026. This is not a production audit, a customer-specific architecture, or a service agreement. Signed service and data-processing terms define the purchased scope.

Review retention Security answers Sources

Review each data category.

Source working copies, retained evidence, and provider processing have different lifecycles. Agree a schedule for the deployment you choose.

Data categories, evidence-backed position, and deployment review questions
Category	Reviewed position	Agree for your deployment
Source working copies and caches	Temporary checkout cleanup exists; source review also identified a repository mirror cache. Do not treat all source storage as transient.[S7]	Agree cache eligibility, deletion timing, failed/cancelled-job cleanup, and any deployment requirement that prohibits caching.
Findings, reports, and code snippets	Findings and reports are retained review artifacts and can contain affected code snippets.[S7][S1]	Agree access, ownership, export, retention periods, deletion triggers, and downstream integration copies.
Resume state and agent/session traces	Recovery snapshots and local session traces can persist analysis context and transcripts.[S7]	Confirm enabled trace categories, permitted content, access, retention, and removal after completion or cancellation.
Accounts, credentials, jobs, and API events	Account and job records persist. API event metadata is distinct from other logs; encrypted onboarding credentials require configured storage controls.[S7][S3]	Agree purpose, access, credential revocation, retention, audit export, and deletion exceptions for each record type.
Backups and recovery copies	Backup selection in reviewed source includes application/analysis records and report artifacts; actual deployment policies were not inspected.[S7]	Request backup retention and expiry, deletion propagation, restore-test evidence, RPO/RTO, and responsibility ownership.
Model-provider inputs and outputs	Analysis can transmit source context to the configured provider. Provider credentials do not determine retention or training restrictions.[S1][S7]	Agree provider and account, subprocessors, processing region, training-use restrictions, retention eligibility, and deletion terms.

Common security-review questions

Answers distinguish public documentation, selected implementation evidence, and terms to confirm.

01Who provides Winfunc and which terms govern the purchase?

By agreement

Winfunc is offered by Stition, Inc. Confirm the contracting entity and signed service schedule, MSA, and DPA. Website privacy and use terms are public references, not a substitute for service-specific commitments.[S5][S6]

02How is repository access scoped?

Implementation evidence

Repository authorization checks are present in reviewed implementation paths. Agree selected repositories, installation permissions, reviewer access, and how access is revoked before expanding scope.[S2][S7]

03Where will the service run?

By agreement

Customer-controlled hosting and isolated-environment options are scoped by agreement. Record the selected deployment, infrastructure owner, support and upgrade responsibilities, and permitted integrations.[S1]

04Can source code be transmitted outside the processing environment?

Implementation evidence

Yes. Configured model analysis can transmit source content and application context to inference services. Review provider egress, permitted data, account, processing region, and restrictions for the proposed deployment.[S1][S7]

05Can we use our own model credentials?

By agreement

Customer-owned model credentials are an enterprise option by agreement. Confirm supported providers, account ownership, billing, secret handling, and provider restrictions. This alone does not establish private inference or zero retention.[S1]

06Is customer code used to train models?

Confirm in review

Training-use restrictions must be agreed for both Winfunc processing and the selected provider/account. Request written provider terms and applicable controls; source inspection or customer-owned credentials cannot establish those terms.[S1][S7]

07Which processing regions and subprocessors apply?

Confirm in review

Request the current deployment region, approved inference providers, subprocessor list, and data-transfer terms for your purchase. This pack does not establish a universal region or an exhaustive subprocessor inventory.[S1][S5]

08Is all customer data deleted when a scan ends?

Implementation evidence

No universal immediate-deletion statement is established here. Temporary checkout cleanup differs from source caches, findings, snippets, resume state, session traces, operational records, and backups. Agree each lifecycle using the retention table.[S7]

09How do we request export or deletion?

By agreement

Agree export formats, request ownership, deletion triggers and timelines, exceptions, provider copies, and backup expiry in the service schedule/DPA. The website privacy policy describes rights for website personal data, not a complete service deletion schedule.[S5][S6]

10What backup and recovery assurances are available?

Confirm in review

Reviewed source includes a backup selection path. Request the deployed retention, access/encryption controls, recovery objectives, recent restore evidence, and deletion propagation. This pack does not verify operating effectiveness or a recovery SLA.[S7][S3]

11How are users authenticated and permissions checked?

Implementation evidence

GitHub-backed sessions and repository authorization are present in the inspected source paths. Review roles, installation access, administration, session invalidation, and enforcement for your proposed deployment.[S2][S7]

12Are SSO and automated provisioning included?

By agreement

Federated identity and lifecycle options are scoped by agreement. Confirm the identity provider, protocol, provisioning/deprovisioning behavior, and tested deployment. The inspected paths do not establish universally available SAML or SCIM.[S1][S7]

13What isolation applies to our repositories and environment?

By agreement

Repository access checks are implemented in reviewed paths. Dedicated or customer-controlled environments are options by agreement. Review the actual account, network, storage, model, and administrator boundaries; repository authorization is not complete tenant-isolation evidence.[S1][S7]

14How are data and access credentials protected?

Implementation evidence

Public control summaries describe HTTPS/TLS. Reviewed paths hash read-only MCP keys and support authenticated encryption for onboarding test credentials. Confirm all other token, storage, key-management, and backup protections for the deployment.[S3][S7]

15Do logs contain only metadata and provide a complete audit trail?

Implementation evidence

API event metadata excludes bodies and credential headers in reviewed code, but other agent/session traces can retain transcripts. Event coverage, filtering, saturation behavior, access, retention, and export need review; no universal completeness claim is made.[S3][S7]

16What authorizes testing and use of test credentials?

By agreement

Agree repositories, environments, permitted actions, accounts, network boundaries, and exclusions before testing. Confirm the investigation/validation scope and credential lifecycle with your security and application owners.[S1][S2]

17Who approves patches and changes?

Documented

Winfunc prepares findings and proposed remediation for review. Agree any pull-request creation permissions separately. Your application owner should retain normal change approval, testing, verification, and release controls in the pilot and contract scope.[S1][S2][S8]

18How do we review SOC 2 assurance?

Confirm in review

Request the current SOC 2 report through the Trust Center and confirm the entity, system scope, audit period, exceptions, and any bridge letter. Public control summaries are not the report; its contents were not reviewed for this pack.[S3][S4]

19Which NDA, DPA, and regulated-data terms apply?

By agreement

Confirm required confidentiality, data-processing, subprocessor, and regulated-data terms in your purchase documents. Any BAA/PHI requirements need an explicitly approved processing scope. This pack does not establish suitability for regulated data.[S1][S5][S6]

20What incident notification and support terms apply?

By agreement

Named support and response terms are contracted. Agree escalation channels, customer contacts, incident-notice obligations, response targets, and reporting expectations. The public website use terms do not establish a service-wide notice period or SLA.[S1][S6]

Sources and review scope

S1: Enterprise options and commercial scope (opens in a new tab)
Current public enterprise options are qualified by agreement.
S2: Integrations and workflow availability (opens in a new tab)
Confirm selected integration status, permissions, and workflow scope.
S3: Trust Center control summaries (opens in a new tab)
Published summaries; not an independent review of operating effectiveness.
S4: Trust Center assurance access (opens in a new tab)
Request current assurance reports; report contents were not inspected.
S5: Website privacy policy (opens in a new tab)
Website personal-data practices and rights; service DPA still requires agreement.
S6: Website terms of use (opens in a new tab)
Website terms; not a complete enterprise service agreement.
S7: Selected implementation evidence
Selected implementation paths at revision 4ff82a8 were inspected read-only on October 4, 2026. Detailed supporting evidence can be reviewed with Winfunc; no production verification was performed.
S8: Sample audit and pilot materials (opens in a new tab)
Public research example and a blank pilot scorecard; not customer or production verification.

Download the pack Blank pilot scorecard Plan your evaluation