Security & data
What the export reads, what leaves your system, and how the app is protected. Stated plainly; no badges we do not hold.
In short
Export
One ABAP report with no database INSERT, UPDATE, MODIFY, DELETE or COMMIT. Its only output is the export files, written to a directory you choose.
Product: Display authorizations S_DEVELOP and S_TABU_NAM / S_TABU_DIS, plus S_DATASET to write the files (or S_GUI for a PC download). Tables the user may not display are skipped and logged.
Data
Author, changed-by and every other user-name column are removed. It reads code, dictionary definitions and configuration, never orders, invoices or postings.
Stated limit: IDoc partner profiles are included by default and contain partner numbers (customer, vendor and bank numbers). One checkbox, “Include IDoc partner profiles”, leaves them out. The documentation never writes partner numbers.
AI
The graph, the catalogue and the process map are built without AI. Validation Packages and Ask AI run only with your explicit, recorded authorization; Ask AI is off by default.
Product: Each Validation Package run needs a recorded authorization naming an approver.
Redaction
Names after author labels, SAP user IDs, e-mail addresses, phone numbers and IBAN-like numbers in comments and strings are redacted line by line.
Product: Code stays unchanged, so citations still resolve. Each redaction is recorded for approval.
Access
Every page and API of the web app requires sign-in. There is no self-registration.
Product: One-time passwords are valid for 72 hours and must be replaced at first sign-in. Sessions end after 12 hours idle or 7 days.
Verification
A script, not an AI, re-checks every tag on every catalogue page.
Product: The app shows the result next to each citation: checked, or a warning.
01The export
One ABAP report, installed as a local object. It changes nothing in your system: its source contains no database INSERT, UPDATE, MODIFY, DELETE or COMMIT, and the only DELETE statements act on internal tables. Its only output is the export files, written to a server directory (AL11) or a PC folder that you choose.
| Area | What exactly |
|---|---|
| Custom source code | Programs and includes (reports, module pools, user-exit includes), classes and interfaces (every include), function groups and their function modules, enhancement implementations, and CDS view sources. |
| ABAP Dictionary definitions | Structure, not table contents: customer tables, views, structures, appends, data elements, domains with fixed values and table types. Also the definitions of the SAP tables your code uses. |
| The SAP where-used index | Both directions: who calls your code from SAP, and what your code references. |
| Transactions | Customer transaction codes with their program, screen, parameters and text. |
| Screens | Flow logic and field names. |
| Background jobs | Jobs that run customer programs: job name, step, program, variant name, number of runs in the period (default 90 days), last run date, periodic flag and statuses. No user names. |
| Process configuration | Customizing tables: IDoc process codes; IDoc partner profiles (included by default; one checkbox leaves them out); payment methods and payment medium formats; customer DMEE trees; CMOD projects; classic and new BAdI implementations; table maintenance dialogs (SM30); the SAP modification log (names of modified SAP objects only). |
| Texts | Object, package and message texts: in the selected language, then the master language, then English. |
| Inventory | A list of every customer object of the selection, of all object types, flagged with whether its content was exported. |
| Never read | Details |
|---|---|
| User names | Author, scheduler, changed-by and every other user-name column are removed from every file. The object inventory has no user column either. Source code is exported as written, so a comment can still contain a name or an SAP user ID; before any AI step, personal data in comments and string literals is redacted. |
| Transactional business data | No orders, invoices, postings or similar data. It reads code, dictionary definitions and configuration.Note 1 |
| SAP standard source code | Never read. The one exception is the user-exit includes listed on the selection screen, which hold customer code inside SAP frames. |
| Contents of customer tables | Only their dictionary definitions are read, not their rows. An optional field, “Extra config tables (content)”, reads only the tables you add to it; it is empty by default. |
$TMP), so no transport is needed. About 5 minutes: create, paste, save, activate.S_DEVELOP display, S_TABU_NAM / S_TABU_DIS display, S_DATASET write for the output directory, and S_GUI for a PC download. Tables the user may not display are skipped and logged.Z*, Y*) by default. You can add your own namespace, for example /ABC/*, and narrow by package.02Data flow
You hand over the export archive for analysis. AI steps send code facts and redacted source excerpts to external AI providers (OpenAI or Anthropic), and only with your recorded authorization. The product takes nothing else from your SAP system: there is no live connection to it.
You run it in the background
In your SAP system
Writes the export files to a directory you choose. Changes nothing in your system.
You hand over the export archive
Analysis, without AI
Built from the export alone. Served in the web app, behind sign-in.
Only with your explicit, recorded authorization
External AI providers
Code facts and redacted source excerpts, for writing and reviewing Validation Packages, their Spanish translation and Ask AI.
| What leaves | Where it goes, and when | Your control |
|---|---|---|
| The export archive | Handed over to us for analysis: for the initial assessment, and again for each refresh after a release. | You run the report, choose the output directory and hand over the archive. |
| Code facts and redacted source excerpts | To external AI providers (OpenAI or Anthropic), through their APIs, for the three AI uses described below. | Each use runs only with your explicit, recorded authorization. Ask AI is off by default. |
| Nothing else is taken from your SAP system | There is no live connection to it. | A refresh means running the export again. |
03AI
The evidence graph, the catalogue in English and Spanish, and the process map are built without any AI, from the export alone. AI is used for three things only, and each one runs only with your explicit, recorded authorization.
Writing and reviewing Validation Packages. Each run needs a recorded human authorization naming an approver.
Translating Validation Packages into Spanish. Runs only with a recorded authorization.
Ask AI. Off by default. It stays off until your authorization is recorded.
Before any source code goes to an AI provider, personal data in comments and string literals is redacted line by line:
Code is left unchanged, so citations still resolve. Each redaction is recorded for human approval.
The AI engines are external providers, reached through their APIs. The roles that write and review Validation Packages run on Anthropic Claude or on OpenAI, and the verified Spanish translations of Validation Packages use OpenAI. Ask AI uses OpenAI, and each request is sent with the provider’s do-not-store setting (store=false). What each provider itself retains, for example for abuse monitoring, is set by its own terms; ask us: hello@codegraphai.com.
04Access
05Hosting
Not yet published on this site: where the web app and your export archive are hosted, in which region, how long the archive is kept after the engagement, and which agreements cover it (for example a non-disclosure or data processing agreement). Ask us before you hand over an export: hello@codegraphai.com.
06Independence
CodeGraphAI is an independent product. SAP names on this site describe the SAP systems and objects the product works with; they are not the names of our features.
or write to hello@codegraphai.com