# Security AI Tool Evaluation: Snyk

## Tool Overview
**Name:** Snyk
**Type:** Developer Security Platform
**Website:** https://snyk.io
**Primary Function:** Code security scanning, dependency vulnerability detection, container security, IaC security

---

## Privacy Policy & Enterprise Compatibility

### Commercial/Enterprise Use Permission
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://snyk.io/privacy-policy/
- Terms of Service: https://snyk.io/policies/terms-of-service/
- Enterprise Documentation: https://docs.snyk.io/

**Key Questions:**
- Does the privacy policy explicitly permit commercial use?
- Are there any restrictions on enterprise deployment?
- What is the licensing model for commercial use?

### Data Training & Model Use
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://snyk.io/privacy-policy/
- DeepCode AI Terms: https://snyk.io/product/snyk-code/ (Snyk uses AI for code analysis)
- Data Processing Agreement: Available through enterprise sales

**Key Questions:**
- Is customer code used to train or improve AI models?
- Can customers opt out of data collection for model training?
- How is code analyzed (locally vs cloud)?
- What data is collected during scans?

### Data Retention Policies
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://snyk.io/privacy-policy/
- Data Processing Agreement (DPA)
- Security documentation: https://snyk.io/product/secure-development/

**Key Questions:**
- How long is scan data retained?
- How long are vulnerability reports stored?
- What is the data deletion policy?
- Can customers request data deletion?

### Data Sharing Policies
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://snyk.io/privacy-policy/
- Subprocessor List: Check privacy policy or DPA
- Security whitepaper

**Key Questions:**
- Is data shared with third parties?
- Who are the subprocessors?
- Is data shared across Snyk customers?
- Are vulnerability patterns aggregated/anonymized?

### IP & Confidentiality Concerns
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Terms of Service: https://snyk.io/policies/terms-of-service/
- Enterprise Agreement
- Intellectual Property Policy

**Key Questions:**
- Who owns the IP rights to scan results?
- Are there confidentiality protections for proprietary code?
- What happens to customer code during scanning?
- Is code stored or only analyzed?
- Are there NDA provisions for enterprise customers?

---

## Pricing & Plans

### Free Tier
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Pricing Page: https://snyk.io/plans/
- Free Tier Documentation: https://docs.snyk.io/getting-started/snyk-plans

**Information Needed:**
- **Features Included:** List specific features (e.g., Snyk Open Source, Snyk Code, etc.)
- **Project Limits:** Number of projects that can be scanned
- **User Limits:** Number of team members
- **Scan Limits:** Number of scans per month
- **Test Limits:** Tests per month
- **Duration:** Is it free forever or a trial?
- **Support Level:** Community vs paid support

### Paid Plans
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Pricing Page: https://snyk.io/plans/
- Contact sales for enterprise pricing

**Plans to Document:**

#### Team Plan
- **Cost:** $ per user/month (check current pricing)
- **Features:** List key features
- **Limits:** Projects, users, scans, tests
- **Support:** Level of support included

#### Business Plan
- **Cost:** $ per user/month (check current pricing)
- **Features:** Advanced features beyond Team
- **Limits:** Higher limits or unlimited?
- **Support:** Priority support?

#### Enterprise Plan
- **Cost:** Custom pricing (contact sales)
- **Features:** Full feature set, SSO, advanced integrations
- **Limits:** Typically unlimited or very high
- **Support:** Dedicated support, SLAs
- **Additional:** Custom DPA, compliance certifications

---

## Usage Limits

### API Rate Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- API Documentation: https://docs.snyk.io/snyk-api
- Rate Limiting Documentation

**Information Needed:**
- Requests per hour/day
- Concurrent scan limits
- CLI usage limits
- Different limits per plan tier

### Project Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Number of projects per organization
- Number of active projects
- Limits vary by plan tier

### User/Seat Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Minimum seats for paid plans
- Maximum collaborators
- Guest user policies

### Scan Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Number of scans per month
- Size limits for scanned repositories
- Timeout limits for scans
- Concurrent scan limits

---

## Enterprise-Specific Considerations

### Compliance & Certifications
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Security page: https://snyk.io/trust-and-security/
- Compliance documentation

**Check for:**
- SOC 2 certification
- ISO 27001
- GDPR compliance
- CCPA compliance
- Industry-specific compliance (HIPAA, etc.)

### Deployment Options
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- Cloud-hosted (SaaS)
- Self-hosted/on-premise options
- Private cloud deployment
- Air-gapped environment support

### Security Features
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- SSO/SAML support
- Role-based access control (RBAC)
- Audit logging
- Data encryption (in transit and at rest)
- Broker for on-premise scanning

---

## Research Checklist

- [ ] Read complete privacy policy
- [ ] Review terms of service
- [ ] Check pricing page for current costs
- [ ] Review API documentation for rate limits
- [ ] Check for Data Processing Agreement (DPA)
- [ ] Verify GDPR/compliance information
- [ ] Review documentation for deployment options
- [ ] Check for customer references/case studies
- [ ] Contact sales for enterprise-specific information
- [ ] Review security whitepaper if available

---

## Additional Resources

- Documentation: https://docs.snyk.io/
- Security: https://snyk.io/trust-and-security/
- Support: https://support.snyk.io/
- Blog: https://snyk.io/blog/
- GitHub: https://github.com/snyk

---

## Notes

**Important Considerations for Snyk:**
1. Snyk acquired DeepCode (AI-powered code analysis) - understand how AI is used
2. Check if Snyk Code (SAST) has different data handling than Snyk Open Source
3. Verify if Snyk Broker (for on-premise scanning) addresses data sovereignty concerns
4. Understand the difference between CLI, IDE, and CI/CD scanning for data handling
5. Check if vulnerability database updates require data sharing

**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
**Researcher:** [TO BE COMPLETED]
**Verification Status:** Template - Requires Manual Research