Trust
Data handling
What shipLua keeps, what it discards and why.
| Data | What we keep | How long |
|---|---|---|
| Account | Email, display name, password hash, session hashes, encrypted authenticator secret and hashed recovery codes when two-step is on | While the account exists |
| Workspace | Name, members and roles, experiences you create | While the workspace exists |
| Roblox connections | Envelope-encrypted OAuth refresh/access tokens and scoped Open Cloud API keys, bound to the workspace; deleted on disconnect | While the connection exists |
| Audit runs | File name, SHA-256 hash, size, script and instance counts, duration | With the experience |
| Findings | Rule, location, message, a short excerpt with credentials masked, triage history | With the experience |
| AI reviews | The AI’s findings with a short excerpt copied from your code, model name, token counts | With the experience |
| Activity log | Who did what and when, with IP address and user agent | Append-only |
Uploads
The file you upload is held in memory while Guardian parses it and is not written to disk or object storage. Only the facts listed above are saved. Uploading the same file twice produces the same hash, which is how the report can tell you nothing changed.
Excerpts
To make findings useful, each one stores a few lines of the script around the issue. Patterns that look like credentials, such as Discord webhook tokens, bearer tokens and common API key formats, are masked before anything is stored. Masking is pattern-based and cannot recognise every secret, which is why credentials in scripts are reported as findings in their own right.
Player feedback
Notes players send through your game's feedback form are stored with a pseudonymous player code, never a Roblox name or id, and names of players in the server are replaced before the note is sent. They are deleted automatically 30 days after they arrive, or after the period your studio picks (7 to 365 days).
Deletion
Self-service deletion of accounts and workspaces is in development. Until it ships, email the address from your early-access invitation and we will delete your data, except activity log entries we are required to keep for security.
AI processing
Guardian audits use deterministic rules and do not send your code to an AI model. AI review is a separate, opt-in step: you tick it for an upload, or turn it on in the Studio plugin. Owners, admins and developers can ask for it; analysts and viewers cannot.
When you ask for one, shipLua picks the server scripts most likely to matter (ones that handle remotes, data stores, purchases or per-frame work, plus any Guardian flagged), masks credentials, and seals them with the workspace’s envelope key. The worker sends them to Anthropic’s API, and the sealed copy is erased as soon as the review ends, whether it succeeds or fails. If it never runs, it is erased after 24 hours. Scripts with none of those signals, such as plain UI code, are not sent.
The AI can only answer; it has no tools and cannot change anything. Each of its findings must name a check from a fixed list and a line that exists in the code sent, or it is dropped. The excerpt you see is copied from your code by shipLua, not written by the model. AI findings are shown apart from Guardian’s and are suggestions to verify.