To a prospect, customer, or your Salesforce Admin.
Production, sandbox, or multiple orgs.
Reads objects, field definitions, flows, profiles, permissions, installed packages, and record counts.
Derived, anonymized findings — the only thing that leaves the container.
Purge — on completion the access token and every byte of retrieved metadata are deleted (kept only if you schedule ongoing monitoring).
Never retrieved: transactional data, customer records, field values, and any PII / PHI. It never leaves your org — ensuring compliance.