Feature · Find · Written by Yobel Tzegai · Last checked 19 October 2026

Can Complipath find the AI in our code and logs?

Yes, read-only, on Growth: today that means pilot workspaces, because Growth is not for sale yet. In Complipath (complipath.io), you connect GitHub or GitLab and it reads the code files of the repositories you choose for AI libraries, calls to AI services and the names of AI keys, never their values. It suggests what it found for your register, and a person adds it.

Check your AI systems, free

What it does today, and its limits

Connect GitLab, GitHub, Datadog (logs and LLM Observability), Azure Monitor, Claude, ChatGPT or any log system read-only, each on its own page: Complipath reads the code files in your repositories for AI libraries, calls to AI services and AI key names (never their values), skipping vendored, build, test and lock files, secrets files, files over 200 KB, documents and images, up to 20,000 code files and 400 MB per repository; it shows progress and one result, suggests what it found for the register, and checks your logs; disconnecting deletes the access at once.

Illustration · not your dataConnection GitHub · read-only · 2 repositories chosenFound openai in package.json · OPENAI_API_KEY named in .env.exampleSuggestion Support Chatbot · Add to register or Ignore

What it reads

GitHub, through the Complipath GitHub App on the repositories you choose, or a fine-grained read-only token. GitLab, through sign-in with GitLab or a token with read access.
In each repository: dependency files and source files, for AI libraries, calls to AI services, model names and the names of AI keys such as OPENAI_API_KEY. Never a key's value.
Logs: Datadog, Azure Monitor, or any log system that sends events to a signed address. Only events since the last read, at most one day back.
Claude and ChatGPT with an organisation admin key: which workspaces or projects exist and which models were used in the last 30 days.

What it does not read

Vendored code, build output, tests, lock files, secrets files such as .env and key files, files over 200 KB, documents and images.
More than 20,000 code files or 400 MB in one repository. Past that, the repository is marked partly read, never as fully checked.
The data-retention and training settings of Claude or ChatGPT: neither vendor's admin interface shows them, so the page links to them instead.

What it keeps

The file, the line, the name it matched and the vendor. Never whole files, never whole logs.
At most three masked excerpts per problem, emptied after 30 days.
Disconnecting deletes the stored access at once; for the GitHub App it also uninstalls the app, and you choose whether the findings stay.

Which plan

Growth, which is not for sale yet: Connections are open today to pilot workspaces. On Starter and the trial, every connection card shows what it does, marked Part of Growth.

Where it sits in the law

The connections name no article themselves. What they read feeds Live, whose checks name Article 50(1) and Articles 14 and 26 of Regulation (EU) 2024/1689, and Article 5(1)(c) of the GDPR.
An AI system found in code is a suggestion. It enters your register only when a person adds it, and it is classified like any other.

Where it is in the app

Settings, then Connections: one card per tool, each with its own page, a status, the time of the last and next read, and Check now.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Does Complipath copy our source code?

No. It downloads each chosen repository once per read, scans the code files in memory and keeps only the file, the line, the matched name and the vendor. It skips vendored code, builds, tests, lock files, secrets files, files over 200 KB, documents and images.

Can the connection change our code?

The GitHub App asks for read-only access to contents and metadata. A GitHub token should be fine-grained with Contents: read; a classic token with write scopes is accepted with a warning that it could change your code. GitLab asks for read_api and read_repository.

How often does it read?

Every hour, and after each push to the default branch through the GitHub App or a GitLab webhook you add. A GitHub token connection is read hourly only. Check now starts a read at once, and each connection can switch hourly reads off.

Which plan includes it?

Growth, which is not for sale yet; today Connections are open to pilot workspaces. Starter, at €499 a month for up to 20 AI systems, shows every connection card marked Part of Growth. Prices exclude VAT.