Security & compliance

We are SOC 2 ready: our practices are built for a SOC 2 audit. We have not yet started a SOC 2 audit; we’ll pursue one as our customers’ needs grow.

SOC 2: ready, not certified. Audit not yet started.

Practices in place

• Least-privilege access, with periodic access reviews.
• 2FA required on GitHub for every member; MFA active on the AWS root account and the only human AWS user.
• Audit logging (AWS CloudTrail) with a defined retention period.
• Encryption at rest (AWS KMS, a separate key per customer repository) and in transit (TLS).
• Tested backups and a documented restore process.
• Change management: every change is reviewed, gated by CI, and released in stages.
• Vulnerability scanning of our own code and dependencies.
• A web application firewall and rate limiting in front of our application.
• A written incident response plan.
• Code retention limits: most customer code-derived data expires 30 days after last activity; one known exception (cross-repository claim summaries) does not yet expire on that schedule. All code-derived data is deleted when a repository is uninstalled.
• Vetted AI model providers only.
• An Ohio, USA company .
• Errors and omissions, and cyber liability insurance, in place.

Learn more

• What our security review checks on every pull request.
• Privacy: what this site collects, and why.
• Security and data retention: how long we keep code-derived data and who processes it.
• Vulnerability disclosure policy: how to report a security issue, and our safe harbor for good-faith research.
• Subprocessors: who processes data on our behalf, in detail.

Subprocessors

Who processes data on our behalf, what they receive, and where, is on the Subprocessors page.

Need security documentation?

Email support@mergesafe.ai for our security questionnaire answers. A Data Processing Agreement is available on request: email support@mergesafe.ai.