Trust & compliance

Built for a SOC 2 audit. Open about the rest.

We’re SOC 2 ready: every practice below is in place today. We haven’t started the audit yet.

SOC 2Type II
Ready · audit not yet started

No auditor engaged yet, so no report to share.

Documents

support@mergesafe.ai

Practices in place

Full details →

Access

  • Least-privilege access, with quarterly access reviews
  • 2FA required for every member of our GitHub organization
  • MFA on the AWS root account and the only human AWS user

Data protection

  • Encrypted at rest with AWS KMS; code-derived data has a separate key per repository, deleted on uninstall
  • Encrypted in transit with TLS, with HSTS
  • Code-derived data expires 30 days after last activity, and is deleted when a repository is uninstalled
  • Vetted AI model providers only

Operations

  • Audit logging with AWS CloudTrail in every region, kept for 400 days
  • Point-in-time backups, with a documented and tested restore process
  • Every change goes through a pull request, CI, a MergeSafe review and a merge queue, then staging before production
  • Secret, dependency, infrastructure, container and workflow scanning on every push
  • Web application firewall in front of the app and webhooks, with rate limiting

Company

  • A written incident response plan
  • Errors and omissions, and cyber liability insurance
  • An Ohio, USA company

Subprocessors

What each one receives →
  • Amazon Web Services•Hosting

    Compute, storage, database, DNS, CDN and email, in us-east-1.

    USA
  • GitHub•Code host

    Your code, the GitHub App, sign-in, and where reviews are posted.

    USA
  • OpenAI•AI inference

    Model inference for reviews: diff hunks and context from the pull request.

    USA
  • Anthropic•AI inference

    Model inference for reviews: diff hunks and context from the pull request.

    USA
  • Sentry•Error reporting

    Our own app errors only. Scrubbed events, no code.

    USA
  • Stripe•Payments

    Top-ups on Stripe’s hosted pages. We never see card details.

    USA
  • Google Workspace•Email

    Company email. No code or review content.

    USA

OpenAI, Anthropic, GitHub and the other names and logos here are trademarks of their owners, shown only to identify the services we use. No endorsement is implied.

Integrations you connect

Integration docs →

These run against your own accounts, only when you connect them, so they aren’t subprocessors. Disconnect any of them at any time.

  • Sentry•Error triage

    Reads new and regressed issues from your Sentry project, and can file them as triaged GitHub issues. If you turn on auto-fix, it can open a verified fix as a pull request.

    Your account
  • Jira•Issue tracking

    Reads your issues, checks them against the code and any open pull request, and comments with what it finds.

    Your account
  • Linear•Issue tracking

    Reads your issues, checks them against the code and any open pull request, and comments with what it finds.

    Your account
  • Slack•Commands & notifications

    Trigger MergeSafe from Slack, and get review updates in the channel you choose.

    Your account

Start with your next pull request.

Keep the light on, from $0.25 per review.

Join the revolution
Sign up with GitHub · $20 free to start.