How to delete your DeepSource account

About deleting your DeepSource account

DeepSource is an automated code review platform that integrates directly into your version control system, such as GitHub, GitLab, or Bitbucket. By scanning your source code for anti-patterns, security vulnerabilities, and performance issues, DeepSource helps engineering teams maintain high code quality. Because the service requires deep access to your private repositories, users may eventually choose to disconnect the service for security audits, project conclusion, or internal compliance mandates.

Reasons to delete a DeepSource account often revolve around sensitive project workflows or minimizing the attack surface of automated third-party tools. If your team is sunsetting a project or migrating to a different static analysis tool, removing your account ensures that DeepSource no longer maintains read-only access to your codebases. Key factors driving deletion include:

• Need to revoke third-party API access to private Git repositories.
• Desire to purge historical code analysis reports and metadata from external cloud environments.
• Transitioning to a self-hosted analysis solution to ensure total control over source code visibility.

What happens to your data

When you initiate the deletion process for your DeepSource account, the platform triggers a cascade of removals across its internal databases. DeepSource typically purges your authentication tokens, user profile metadata, and specific configurations associated with your analyzed repositories. Understanding the scope of this cleanup is vital for maintaining your security posture.

• Analyzed Code Snippets: DeepSource removes the temporary code fragments stored for analysis purposes.
• Repository Metadata: The record of which repositories were linked to your account is purged.
• User Identity Information: Your associated email, OAuth connection tokens, and account history are removed.
• Issue Logs: Historical records of detected security vulnerabilities or style issues linked to your account are permanently deleted.

While DeepSource deletes active records, note that aggregated, non-identifiable telemetry data used for platform performance improvements may persist in backups or internal logs according to their standard data retention policies. If you have concerns about persistent logs, reach out to their support team before final deletion.

Privacy considerations

Using DeepSource involves granting significant permissions to your version control systems. Because DeepSource acts as a gateway into your codebase, users should be aware of how their data is handled. Proper offboarding is an essential part of the lifecycle management of any developer tool.

• Audit Permissions: Regularly check the 'Applications' or 'Authorized Apps' section of your GitHub or GitLab profile to ensure the DeepSource token has been revoked.
• Data Residency: Understand that DeepSource analyzes code on their servers; deletion is the only way to ensure your code is no longer residing in their processing environment.
• Residual Access: Ensure you have manually removed any specific webhooks or service hooks that DeepSource may have installed in your repository settings if the automatic deletion leaves them behind.

Frequently Asked Questions

Does deleting my account remove my repositories from GitHub?

No, deleting your DeepSource account only removes the connection and the analysis data held by DeepSource; your original code remains untouched on your Git provider.

Can I recover my analysis reports after account deletion?

No, account deletion on DeepSource is permanent. Once the account is deleted, all historical reports and configuration settings are unrecoverable.

Is it necessary to remove DeepSource webhooks manually?

While the platform attempts to clean up, it is a best practice to verify that no remaining webhooks are pointing to DeepSource servers in your repository settings after your account is closed.

Will my team members still see the analysis results?

If you were the owner of the DeepSource organization, deleting your account will likely remove access for everyone within that organization. Ensure you transfer ownership if you wish to keep the service running for your team.

How long does it take for DeepSource to purge my data?

Most data is removed from active databases immediately upon account deletion confirmation, though some data may remain in secure, encrypted backups for a short period according to their retention policy.

Should I revoke my GitHub token before deleting my DeepSource account?

It is a highly recommended security practice to revoke the OAuth token in your GitHub settings after you have confirmed the account deletion in DeepSource.