Every Polaris engagement produces a cryptographic audit trail anchored to the Bitcoin blockchain — independently verifiable proof of exactly how your source code was handled.
The problem
When you hand over a codebase for due diligence, you're trusting the analyst with your company's core intellectual property — trade secrets, proprietary algorithms, security architecture, and business logic.
Most due diligence providers ask you to take their word that your code was handled responsibly. They might have an NDA and a verbal assurance. But you have no way to verify what actually happened — when your code was accessed, what was done with it, or whether it was truly deleted afterwards.
Polaris eliminates that trust gap entirely.
Tamper-evident audit trail
From the moment your repository is received to the moment it is permanently destroyed, every event in the analysis lifecycle is recorded in a SHA-256 hash chain.
Each event — code received, scanner executed, report generated, code deleted — is hashed using SHA-256. Critically, each hash incorporates the hash of the previous event. This means altering any single record invalidates every subsequent hash in the chain.
A typical engagement records 35–40 chained events. Any tampering — even changing a single character in a single event — is immediately detectable by recomputing the hash chain.
Blockchain anchoring
After the audit trail is complete, the chain tip hash is submitted to the Bitcoin blockchain via OpenTimestamps — an open, independently verifiable timestamping protocol used by archivists, legal professionals, and security researchers worldwide.
The Bitcoin blockchain is the most widely distributed, immutable ledger available. A timestamp anchored to it cannot be forged, backdated, or revoked — by Polaris or by anyone else. Unlike proprietary timestamping services, OpenTimestamps is open-source, free to verify, and will remain functional for as long as the Bitcoin network exists.
.ots proof file — the cryptographic receipt linking the audit trail to the Bitcoin blockchainots verify at opentimestamps.orgData lifecycle
Your source code follows a strict, auditable lifecycle. Every stage is hash-chained and independently verifiable.
Client source code is never stored beyond the analysis window. Once the report is generated, the repository is permanently deleted from all systems. The audit trail — which contains no source code, only metadata and hashes — is the sole record that the engagement occurred.
Infrastructure
Analysis runs on dedicated infrastructure that is purpose-built for handling sensitive source code.
Our methodology
A growing number of "code analysis" tools are thin wrappers around large language models — they paste your source code into ChatGPT or a similar service and return whatever the model generates. This is fundamentally unsuitable for due diligence. Here's why.
A language model works by predicting the most likely next word. It doesn't execute your code, parse your dependency tree, or query vulnerability databases. It pattern-matches against its training data — which means it can confidently state that a vulnerability exists when it doesn't, or miss a critical one entirely because it doesn't resemble anything in its training set. In due diligence, a false positive can derail a deal; a false negative can let a material risk through undetected.
Ask a language model to analyse the same codebase twice and you will get two different answers — different findings, different severity ratings, different conclusions. This is inherent to how they work, not a bug that can be fixed. Polaris scanners are deterministic: the same code produces the same findings, the same ratings, and the same report every time. This is essential when findings need to withstand legal scrutiny or inform underwriting decisions.
AI-wrapper tools send your source code — your company's most sensitive intellectual property — to third-party cloud APIs for processing. You have no control over how it's stored, cached, logged, or used for model training. Polaris runs all 16 scanners locally on dedicated, isolated infrastructure. Your code never leaves the analysis environment and is never transmitted to any external service.
Each of our 16 scanners performs a specific, well-defined analysis task using purpose-built logic — not a prompt. For example:
Due diligence exists to reduce uncertainty. A tool that introduces its own uncertainty — through hallucination, non-determinism, and uncontrolled data handling — defeats the purpose. Every finding in a Polaris report can be traced back to a specific scanner, a specific data source, and a specific rule. Nothing is inferred, estimated, or imagined.
Certificate
The Data Handling Certificate is a standalone document that summarises the chain of custody for your engagement. It is designed to be shared with stakeholders — investors, legal teams, compliance officers — as evidence of responsible data handling.
You can view real Data Handling Certificates from our sample engagements on the Sample Reports page.
Verification
The entire system is designed so that you — or any third party — can independently verify every claim without contacting Polaris.
.ots proof file from Polaris (delivered with every report)ots verify (available at opentimestamps.org) to confirm the audit trail was anchored to the Bitcoin blockchain at the stated timeNo proprietary tools, no Polaris login, no trust assumptions. The cryptography speaks for itself.
We're happy to walk through our data handling process in detail, or provide additional technical documentation for your compliance team.
[email protected]