project policies

Signing & privacy

Code signing policy

Windows releases are code-signed with an Organization Validation (OV) code signing certificate issued to IronSights Pty Ltd, obtained through VeroKey / SSLTrust (a DigiCert partner). The signing key is generated in and never leaves an Azure Key Vault hardware security module (FIPS 140-2 Level 2).

What gets signed

The two Windows executables attached to tagged GitHub releases — scancrypt.exe (command line) and scancrypt-gui.exe (desktop app). Signed binaries are always built from this project's own public source code; the project never signs third-party binaries. The macOS archive is currently not code-signed.

How releases are built and signed

Every release binary is produced automatically by GitHub Actions from the public repository at a version tag. A release gate refuses to build unless the tag exactly matches the version in source. Signing then runs in a protected release environment, authenticating to Azure with a short-lived OIDC token (no long-lived secret is stored); the certificate's private key stays inside the Key Vault HSM and is only ever used to produce a signature. Signatures are RFC 3161 timestamped, so they remain valid after the certificate expires. There are no manual build or signing steps.

Team and roles

Ryan Balloot (IronSights Pty Ltd) — maintainer; acts as author, reviewer, and release approver.

External contributions arrive as public pull requests, require a Developer Certificate of Origin sign-off, and are reviewed by the maintainer before merge. All project accounts use multi-factor authentication.

Verifying a download

Signed releases: right-click the .exe → Properties → Digital Signatures. The signature should verify and name IronSights Pty Ltd as the signer, with the certificate issued by DigiCert.
Any release: compare the file's SHA-256 hash against the checksums on the release page.

Releases published before the signing certificate was in place (v1.0.0) are unsigned; verify those by SHA-256. Because this is an OV certificate, Windows SmartScreen may still show an "unrecognized app" notice on early signed releases until download reputation accumulates. That is expected and not a sign of tampering; verify by SHA-256 if in doubt.

Privacy

The software

ScanCrypt runs fully offline and collects nothing. It has no telemetry, no update phone-home, no accounts, and it never transmits your data anywhere. It reads the files and disks you point it at strictly read-only, and writes reports and recovered data only to locations you choose.

This website

scancrypt.org sets no cookies and runs no analytics or tracking scripts. The site is static, hosted on GitHub Pages and served via Cloudflare; those providers may log standard request metadata (such as IP address and user agent) under their own policies. Page fonts are loaded from Google Fonts.

Contact and issues

Email sent to @scancrypt.org addresses is read by the maintainer and used only to respond to you. GitHub issues are public — never include victim-identifying data in one (see the code of conduct).