Security
Enterprise-grade isolation, zero model training, and ephemeral stateless analysis pipelines.
Architectural Guarantees & Code Privacy
GitCaptain operates under strict privacy-first, zero-retention principles. Your source code is analyzed strictly in temporary memory and never stored on persistent disks.
Code Storage & Privacy
Tree-sitter AST parsers run in isolated worker processes. We never keep persistent git clones on disk.
API Key Security
TLS 1.3 on all connections. Database metadata and customer API keys are encrypted with AES-256.
GitHub Permissions & Network
Short-lived tokens limited strictly to reading diffs and posting review comments on your PRs.
Security Issues & Reports
Direct reporting channel with rapid 24h response times and safe harbor for good-faith researchers.
Code Storage & Privacy
Architecture: Ephemeral by Default
The safest way to protect source code? We don’t store it.
When a PR opens, files stream over TLS 1.3 straight into temporary worker RAM. Our Tree-sitter parsers analyze function and syntax relationships, deliver your review, and instantly wipe the memory clean.
- Zero bytes saved to persistent disk
- Zero git clones created on our servers
- 100% in-memory AST syntax processing
API Key Security
If you choose to configure personal AI provider keys on the API Keys page (/apis):
- Encrypted at Rest - Keys are encrypted with AES-256 before being written to our database.
- Memory-Only Decryption - Keys are decrypted strictly in temporary memory during active API requests, never saved to disk or logs.
- Client Protection - Raw keys are never returned to the browser in client bundles.
GitHub Permissions & Network
Least Privilege Scopes
We request only read access to files (to parse syntax trees) and write access to pull requests (to post review comments). We never ask for admin rights, billing access, or repo deletion rights.
Network Isolation & DDoS
Internal databases and vector services operate in isolated virtual networks with restricted access behind Cloudflare Anycast edge proxies and automated DDoS (Distributed Denial-of-Service) protection.
Security Issues & Reports
We welcome security reports from independent researchers and developers. If you believe you have discovered a vulnerability:
HOW TO REPORT A VULNERABILITY
Email: support@gitcaptain.com
Response SLA: Initial acknowledgment within 24 hours.
Safe Harbor: We provide safe harbor and will not take legal action against researchers acting in good faith.
Have Questions About Security or Compliance?
Our engineering and compliance teams are available to review custom SOC2/ISO requirements, sign Data Processing Addendums (DPAs), or schedule a dedicated security review.