> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/overview-of-kubernetes-integration/how-snyk-controller-handles-your-data.md).

# How the Snyk Controller handles your data

How the Snyk Controller handles your data in the Kubernetes integration

After you install the Snyk Controller in your Kubernetes cluster, it pulls images from your container registries:

1. The Snyk Controller has read-only access to the Kubernetes workloads and container registries.
2. The Snyk Controller pulls images to disk, scans them, and then deletes the images once the scanning completes.
3. The Snyk Controller collects only the minimum relevant information in order to perform vulnerability analysis, specifically the list of dependencies in the image and the workload metadata.
4. The data that the Snyk Controller collects is stored in Snyk's backend, but it is deleted after eight days. Below is the data that Snyk Controller collects:
   * Workload metadata (Kubernetes configuration):
     * Labels, annotations
     * PodSpec
   * Image scan results and image metadata:
     * List of OS packages
     * Application dependencies
5. The Snyk Controller's scanning result is available for import in the Snyk Web UI after some time between a few minutes and a few hours. The length of the delay depends on multiple factors:
   * The Snyk Controller doing the first scan of the cluster
   * The size of the Kubernetes clusters and workloads
   * How the customer uses manual or auto-import of the Kubernetes workload
   * The size of the images
   * The size of scanning queues
   * The network speed.

{% hint style="warning" %}
Snyk highly recommends NOT storing sensitive data in plain text as an environment variable in the container, for example, password, authentication token, and SSH key. Alternatively, you can store the sensitive data in a Secret, mount it as a Volume, and access the information from there.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.snyk.io/scan-fix-and-prevent/scan-with-snyk/snyk-container/kubernetes-integration/overview-of-kubernetes-integration/how-snyk-controller-handles-your-data.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.