Overview

What is HoundDog.ai?

HoundDog.ai is an ultra fast, deterministic code scanner that maps your application’s sensitive data flows and how its APIs and services connect. It is built in Rust for speed and portability, runs locally or in CI, and your code never leaves your environment by default.

It traces 100+ sensitive data types, including PII, PHI, CHD, and auth tokens, into logs, storage, APIs, third party services, and AI integrations. Optional but highly recommended AI analysis uses your organization’s own LLM provider API key to close false positives, adjust severities, and add context using only dataflow traces already detected by the scanner.

A single hounddog scan produces two complementary results:

Privacy Code Scanner

Analyzes your application’s source code to detect sensitive data flows and leaks while code is being written, not after apps are live and data is already flowing. Maps 100+ data elements across 800+ data sinks. It answers questions such as:

• What data is processed? For example personal data, financial data, and health data.
• Where is data stored? For example logs, files, and databases.
• Who is data shared with? For example AWS, Stripe, LLM providers, and internal microservices.

Teams use it to prevent overlogging of PII, PHI, CHD, and authentication tokens, to uncover hidden third-party and AI integrations, and to automate evidence-based data mapping for privacy compliance frameworks such as GDPR, CCPA, and HIPAA. On the Cloud Platform, the detected dataflows feed privacy reports such as Records of Processing Activities (RoPA) and Privacy Impact Assessments (PIA).

Dataflow Context Engine

Builds a catalog of every gRPC and Apache Thrift service in the scanned code: services, method definitions, server implementations, and client call sites, resolved to file, line, branch, and commit. AI coding agents can consume this context through the agent output format and the built-in MCP server instead of rediscovering it on every prompt, and the Cloud Platform unifies it into a cross-repository API Catalog.

Cloud Platform

The Cloud Platform is the central management layer for the CLI. Scans always run in your environment — locally, in your CI pipelines, or in your IDE-adjacent tooling — and your source code never leaves it. The CLI uploads scan results to the platform, where your organization can triage risky dataflows, customize scan rules, and generate audit-ready privacy reports:

• Repositories: Overview of all code repositories scanned by HoundDog.ai, with scan history and per-repository settings.
• Applications: Group repositories into applications for privacy reports and search.
• Dataflows: Triage sensitive dataflows discovered in your codebases — review severity, change status, run AI reviews, and file Jira or Linear issues.
• Datamap: Explore data elements, data sinks, and dataflows across your codebases in flowchart and table views.
• API Catalog: Explore where gRPC and Thrift services are defined and called across your codebases.
• Privacy Reports: Keep Records of Processing Activities (RoPA) updated as new personal data and subprocessors are detected in source code. Generate Privacy Impact Assessments (PIA) and validate design phase privacy reviews with code level evidence during development.
• Scanner Rules: Customize the scan rules for data elements, data sinks, and sanitizers that every scan in your organization uses.
• API Keys: Personal keys for local development and organization keys for CI/CD.
• Audit Log: Review actions performed by users of your organization.
• Integrations and settings: Source Control, Notifications, Issue Tracking, AI Integration, and Roles and Permissions.

How It Fits Together

1. Install the CLI and authenticate it with an API key.
2. Scan a repository — the CLI downloads your organization’s scan rules and configuration, runs the scan in your environment, and uploads the results.
3. The repository appears under Repositories, and detected dataflows appear under Dataflows for triage.
4. Rule changes you make in the platform (for example, disabling a data element or allowlisting data elements for a sink) apply automatically to every subsequent scan in your organization.

Self-Hosted Platform

As part of the Enterprise plan, organizations can install the full platform on premises. The installation includes both the platform, which runs in lightweight Docker containers, and the CLI scanner. For POCs, the entire installation can run on a developer machine. See Self-Hosted Platform for more details.

Technical Highlights

• Local by default. Runs as a standalone binary on your machine or CI runner. Your code never leaves your environment. For organization-wide, in-network deployment, see Self-Hosted Platform.
• Fast. Scans 1 million+ lines of code in seconds on modern hardware, with differential scans making repeat scans of lightly changed repositories near-instant.
• Deterministic. The scanning engine is fully rule-based static analysis: the same commit produces the same result, every time. An optional AI-powered review can be layered on top of the deterministic findings.
• Deep dataflow analysis. Traces sensitive data through transformations, tainted variables, and file boundaries in the supported languages, down to risky sinks such as LLM prompts, logs, temporary files, and third-party SDKs.

How is it different?

• Complementary to SAST. HoundDog.ai does not replace tools like CodeQL, Semgrep, or Checkmarx. Traditional SAST scanners focus on security vulnerabilities, not privacy risks, and reactive privacy platforms only scan data after it reaches production. HoundDog.ai fills that gap with broad coverage of privacy-focused weaknesses, including CWE-201, CWE-209, CWE-312, CWE-313, CWE-315, CWE-532, and CWE-539.
• Privacy-focused. The rules are purpose-built to map sensitive data flows across storage mediums, third-party services, and AI integrations embedded in code, reducing manual data-mapping overhead and preventing leaks before they ship.
• Turnkey accuracy. HoundDog.ai maintains a meticulously curated set of data element and data sink rules across multiple domains (PII, PHI, PIFI, CHD, secrets), enhanced through AI-assisted workflows, reviewed by human experts, and tested against real-world code.

Free vs Enterprise

The scanner is free to use on Python, JavaScript, and TypeScript codebases. The Enterprise plan unlocks the full language coverage, custom scan rules, privacy reports, the Cloud Platform, and Self-Hosted Platform. See the GitHub repository or the pricing page for current details.

Security and Trust

Visit the HoundDog.ai Trust Center for the latest SOC 2 report, penetration testing results, and SBOM details.

Contact

If you need help or would like to send feedback, create a GitHub issue or email us at [email protected].