Refactor evaluations for Equally AI, Testim, and Virtuoso:
- Removed outdated files and replaced with updated evaluations reflecting current data protection policies and enterprise readiness. - Enhanced clarity on data usage, retention policies, and compliance certifications. - Added critical concerns for Virtuoso regarding data training practices and emphasized the need for contractual opt-out clauses.
This commit is contained in:
olegs committed
1 parent
adf462397e
commit
7d99bdbc91
39 files changed
+2324
-6326
No files matched your search
+75
-198
@@ -1,234 +1,111 @@
|
||||
# Security AI Tool Evaluation: Snyk
|
||||
# Snyk - Enterprise Compatibility Evaluation
|
||||
|
||||
## Tool Overview
|
||||
**Name:** Snyk
|
||||
**Type:** Developer Security Platform
|
||||
**Website:** https://snyk.io
|
||||
**Primary Function:** Code security scanning, dependency vulnerability detection, container security, IaC security
|
||||
**Category:** AI-Powered Developer Security Platform
|
||||
**Date Evaluated:** 2026-02-02
|
||||
|
||||
---
|
||||
|
||||
## Privacy Policy & Enterprise Compatibility
|
||||
## Privacy & Enterprise Use
|
||||
|
||||
### Commercial/Enterprise Use Permission
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Privacy Policy: https://snyk.io/privacy-policy/
|
||||
- Terms of Service: https://snyk.io/policies/terms-of-service/
|
||||
- Enterprise Documentation: https://docs.snyk.io/
|
||||
**Status:** ✅ APPROVED FOR ENTERPRISE USE
|
||||
|
||||
**Key Questions:**
|
||||
- Does the privacy policy explicitly permit commercial use?
|
||||
- Are there any restrictions on enterprise deployment?
|
||||
- What is the licensing model for commercial use?
|
||||
- Designed specifically for enterprise and commercial use
|
||||
- Dedicated Enterprise plan with custom pricing
|
||||
- Enterprise-grade security and compliance certifications
|
||||
- SSO, Jira integration, custom user roles
|
||||
|
||||
### Data Training & Model Use
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Privacy Policy: https://snyk.io/privacy-policy/
|
||||
- DeepCode AI Terms: https://snyk.io/product/snyk-code/ (Snyk uses AI for code analysis)
|
||||
- Data Processing Agreement: Available through enterprise sales
|
||||
### Model Training on User Data
|
||||
**Status:** ✅ NO TRAINING ON CUSTOMER CODE
|
||||
|
||||
**Key Questions:**
|
||||
- Is customer code used to train or improve AI models?
|
||||
- Can customers opt out of data collection for model training?
|
||||
- How is code analyzed (locally vs cloud)?
|
||||
- What data is collected during scans?
|
||||
**Critical Privacy Protections:**
|
||||
- DeepCode AI trained ONLY on permissively licensed open-source projects - NEVER customer data
|
||||
- No proprietary code used for training, optimizing, or fine-tuning AI models
|
||||
- No customer data retained - Snyk does not keep customer code
|
||||
- Short-term caching only for security analysis
|
||||
- Customer code never used for engine training or fix examples
|
||||
|
||||
### Data Retention Policies
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Privacy Policy: https://snyk.io/privacy-policy/
|
||||
- Data Processing Agreement (DPA)
|
||||
- Security documentation: https://snyk.io/product/secure-development/
|
||||
**AI Approach:** Hybrid Symbolic AI + Generative AI
|
||||
- Symbolic AI: Mathematical proof of code paths, near-zero false positives
|
||||
- Generative AI: Plain English explanations, code fix generation
|
||||
|
||||
**Key Questions:**
|
||||
- How long is scan data retained?
|
||||
- How long are vulnerability reports stored?
|
||||
- What is the data deletion policy?
|
||||
- Can customers request data deletion?
|
||||
### Data Retention & Sharing
|
||||
**Status:** ✅ MINIMAL RETENTION, NO EXTERNAL SHARING
|
||||
|
||||
### Data Sharing Policies
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Privacy Policy: https://snyk.io/privacy-policy/
|
||||
- Subprocessor List: Check privacy policy or DPA
|
||||
- Security whitepaper
|
||||
- Short-term caching only for security analysis
|
||||
- No long-term storage of customer code
|
||||
- Customer code NOT shared externally
|
||||
- On-premise container registries supported
|
||||
|
||||
**Key Questions:**
|
||||
- Is data shared with third parties?
|
||||
- Who are the subprocessors?
|
||||
- Is data shared across Snyk customers?
|
||||
- Are vulnerability patterns aggregated/anonymized?
|
||||
### IP & Confidentiality
|
||||
**Status:** ✅ STRONG PROTECTIONS
|
||||
|
||||
### IP & Confidentiality Concerns
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Terms of Service: https://snyk.io/policies/terms-of-service/
|
||||
- Enterprise Agreement
|
||||
- Intellectual Property Policy
|
||||
|
||||
**Key Questions:**
|
||||
- Who owns the IP rights to scan results?
|
||||
- Are there confidentiality protections for proprietary code?
|
||||
- What happens to customer code during scanning?
|
||||
- Is code stored or only analyzed?
|
||||
- Are there NDA provisions for enterprise customers?
|
||||
- Customers own their code and fixes
|
||||
- Clear separation: training data (open source) vs customer data (never used)
|
||||
- SOC 2 Type II, ISO 27001, GDPR compliant
|
||||
|
||||
---
|
||||
|
||||
## Pricing & Plans
|
||||
## Pricing & Plans (2026)
|
||||
|
||||
### Free Tier
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Pricing Page: https://snyk.io/plans/
|
||||
- Free Tier Documentation: https://docs.snyk.io/getting-started/snyk-plans
|
||||
### Free Plan
|
||||
**Price:** $0/developer
|
||||
**Features:** Limited scanning capabilities
|
||||
|
||||
**Information Needed:**
|
||||
- **Features Included:** List specific features (e.g., Snyk Open Source, Snyk Code, etc.)
|
||||
- **Project Limits:** Number of projects that can be scanned
|
||||
- **User Limits:** Number of team members
|
||||
- **Scan Limits:** Number of scans per month
|
||||
- **Test Limits:** Tests per month
|
||||
- **Duration:** Is it free forever or a trial?
|
||||
- **Support Level:** Community vs paid support
|
||||
### Team Plan
|
||||
**Price:** ~$105/month per developer ($1,260/year)
|
||||
- Multiple security products included
|
||||
- Real-time vulnerability scanning
|
||||
- Automated remediation suggestions
|
||||
|
||||
### Paid Plans
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Pricing Page: https://snyk.io/plans/
|
||||
- Contact sales for enterprise pricing
|
||||
### Enterprise Plan
|
||||
**Price:** Custom (varies significantly by scale)
|
||||
- 50 developers: $34,886 - $47,413/year
|
||||
- 100 developers: $67,552 - $89,858/year
|
||||
- Range: $5,000 - $70,000+ depending on needs
|
||||
|
||||
**Plans to Document:**
|
||||
|
||||
#### Team Plan
|
||||
- **Cost:** $ per user/month (check current pricing)
|
||||
- **Features:** List key features
|
||||
- **Limits:** Projects, users, scans, tests
|
||||
- **Support:** Level of support included
|
||||
|
||||
#### Business Plan
|
||||
- **Cost:** $ per user/month (check current pricing)
|
||||
- **Features:** Advanced features beyond Team
|
||||
- **Limits:** Higher limits or unlimited?
|
||||
- **Support:** Priority support?
|
||||
|
||||
#### Enterprise Plan
|
||||
- **Cost:** Custom pricing (contact sales)
|
||||
- **Features:** Full feature set, SSO, advanced integrations
|
||||
- **Limits:** Typically unlimited or very high
|
||||
- **Support:** Dedicated support, SLAs
|
||||
- **Additional:** Custom DPA, compliance certifications
|
||||
**Enterprise Features:**
|
||||
- License compliance
|
||||
- Jira integration, Rich API, Reports
|
||||
- On-premise container registries
|
||||
- Custom user roles, security policies
|
||||
- SSO (Single Sign-On)
|
||||
|
||||
---
|
||||
|
||||
## Usage Limits
|
||||
## Enterprise Compatibility Assessment
|
||||
|
||||
### API Rate Limits
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- API Documentation: https://docs.snyk.io/snyk-api
|
||||
- Rate Limiting Documentation
|
||||
### Strengths ✅
|
||||
- NO customer code used for AI training
|
||||
- Strong privacy and security certifications
|
||||
- Hybrid AI approach (low false positives)
|
||||
- Enterprise features (SSO, custom roles, on-premise options)
|
||||
- Clear data handling policies
|
||||
|
||||
**Information Needed:**
|
||||
- Requests per hour/day
|
||||
- Concurrent scan limits
|
||||
- CLI usage limits
|
||||
- Different limits per plan tier
|
||||
### Concerns ⚠️
|
||||
- Pricing can be expensive for large teams
|
||||
- Enterprise pricing not transparent (custom quotes)
|
||||
- Cloud-based analysis (not fully on-premise)
|
||||
|
||||
### Project Limits
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Information Needed:**
|
||||
- Number of projects per organization
|
||||
- Number of active projects
|
||||
- Limits vary by plan tier
|
||||
|
||||
### User/Seat Limits
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Information Needed:**
|
||||
- Minimum seats for paid plans
|
||||
- Maximum collaborators
|
||||
- Guest user policies
|
||||
|
||||
### Scan Limits
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Information Needed:**
|
||||
- Number of scans per month
|
||||
- Size limits for scanned repositories
|
||||
- Timeout limits for scans
|
||||
- Concurrent scan limits
|
||||
### Recommendations
|
||||
- **APPROVED** for enterprise use
|
||||
- **Best for:** Organizations needing automated security scanning with AI-powered fixes
|
||||
- **Ideal customers:** Medium to large development teams, companies with security/compliance requirements
|
||||
- **Procurement:** Enterprise plan requires budget approval and custom quote
|
||||
|
||||
---
|
||||
|
||||
## Enterprise-Specific Considerations
|
||||
|
||||
### Compliance & Certifications
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Sources to Check:**
|
||||
- Security page: https://snyk.io/trust-and-security/
|
||||
- Compliance documentation
|
||||
|
||||
**Check for:**
|
||||
- SOC 2 certification
|
||||
- ISO 27001
|
||||
- GDPR compliance
|
||||
- CCPA compliance
|
||||
- Industry-specific compliance (HIPAA, etc.)
|
||||
|
||||
### Deployment Options
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Check for:**
|
||||
- Cloud-hosted (SaaS)
|
||||
- Self-hosted/on-premise options
|
||||
- Private cloud deployment
|
||||
- Air-gapped environment support
|
||||
|
||||
### Security Features
|
||||
**Status:** REQUIRES MANUAL VERIFICATION
|
||||
**Check for:**
|
||||
- SSO/SAML support
|
||||
- Role-based access control (RBAC)
|
||||
- Audit logging
|
||||
- Data encryption (in transit and at rest)
|
||||
- Broker for on-premise scanning
|
||||
## Sources
|
||||
1. [Snyk Plans & Pricing](https://snyk.io/plans/)
|
||||
2. [DeepCode AI](https://snyk.io/platform/deepcode-ai/)
|
||||
3. [How Snyk Incorporates Generative AI](https://docs.snyk.io/snyk-data-and-governance/how-snyk-incorporates-generative-ai-into-the-platform)
|
||||
4. [Snyk Pricing 2026 - G2](https://www.g2.com/products/snyk/pricing)
|
||||
5. [Snyk Review 2026](https://aiquiks.com/ai-tools/snyk)
|
||||
|
||||
---
|
||||
|
||||
## Research Checklist
|
||||
|
||||
- [ ] Read complete privacy policy
|
||||
- [ ] Review terms of service
|
||||
- [ ] Check pricing page for current costs
|
||||
- [ ] Review API documentation for rate limits
|
||||
- [ ] Check for Data Processing Agreement (DPA)
|
||||
- [ ] Verify GDPR/compliance information
|
||||
- [ ] Review documentation for deployment options
|
||||
- [ ] Check for customer references/case studies
|
||||
- [ ] Contact sales for enterprise-specific information
|
||||
- [ ] Review security whitepaper if available
|
||||
|
||||
---
|
||||
|
||||
## Additional Resources
|
||||
|
||||
- Documentation: https://docs.snyk.io/
|
||||
- Security: https://snyk.io/trust-and-security/
|
||||
- Support: https://support.snyk.io/
|
||||
- Blog: https://snyk.io/blog/
|
||||
- GitHub: https://github.com/snyk
|
||||
|
||||
---
|
||||
|
||||
## Notes
|
||||
|
||||
**Important Considerations for Snyk:**
|
||||
1. Snyk acquired DeepCode (AI-powered code analysis) - understand how AI is used
|
||||
2. Check if Snyk Code (SAST) has different data handling than Snyk Open Source
|
||||
3. Verify if Snyk Broker (for on-premise scanning) addresses data sovereignty concerns
|
||||
4. Understand the difference between CLI, IDE, and CI/CD scanning for data handling
|
||||
5. Check if vulnerability database updates require data sharing
|
||||
|
||||
**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
|
||||
**Researcher:** [TO BE COMPLETED]
|
||||
**Verification Status:** Template - Requires Manual Research
|
||||
**Last Updated:** 2026-02-02
|
||||
**Key Finding:** Snyk provides strong enterprise privacy protections with NO customer code training. AI trained only on open-source data. Suitable for enterprise security needs.
|
||||
Reference in new issue
Block a user