Security and data retention
Last updated .
How long does MergeSafe keep my code?
Most data derived from your code expires 30 days after the repository or pull request was last active (cross-repository claim summaries are the one exception), is encrypted with a key unique to the repository, and is deleted straight away, key included, when you remove the repository or uninstall the App.
What we keep, and for how long
- 30 days after last use. Anything we store that is derived from your code — the repository index and the findings on your pull requests — expires 30 days after the repository or pull request was last active. An actively reviewed repository keeps its index while it is in use. One exception: cross-repository claim summaries do not yet expire on this schedule, though they are still deleted on uninstall below.
- Deleted on uninstall. Removing a repository from the App, or uninstalling the App, deletes that repository’s stored code-derived data straight away, including older versions.
- Encrypted per repository. Stored code-derived data is encrypted with a key unique to the repository, and the uninstall deletes that key too.
- Working copies are temporary. The checkout used for a review is deleted when the review ends.
- Your review history is kept. After an uninstall we keep a code-free history — your reviews and each finding’s severity, status and location, with the finding’s text removed — for as long as your account exists, so a re-installation finds it. To have it deleted, remove the organization in Settings and ask us (privacy@mergesafe.ai): we then delete those reviews, finding summaries, audit cards and tech-debt items. Billing records stay.
- Billing records (which pull request was reviewed and what it cost) contain no code and are kept for billing.
Who processes your code
- Your code is sent only to vetted AI model providers: OpenAI and Anthropic. We may add or remove reputable AI model providers, and keep this list current.
- We run on Amazon Web Services in the United States.
- Our error reports don’t include file contents or diffs.
Compliance
We are SOC 2 ready: our controls are built for a SOC 2 Type II audit. An audit has not yet started, and we are not certified. See Security and compliance.
The security review
What MergeSafe checks your code for is listed on Security checks. Who processes data on our behalf is on Subprocessors.