Security and privacy
Connecting private repositories to a new platform needs trust. This page states exactly what SIP can access, what it stores, and for how long. It is generated from the same definition the product uses.
Loading…
How SIP protects itself
- Sessions use HttpOnly cookies with CSRF protection; two-factor authentication (TOTP) is available.
- Every organization's data is isolated server-side and covered by automated cross-tenant tests.
- Integration credentials are encrypted. Webhooks (GitHub, Stripe) are verified by signature.
- Outbound fetches are protected against SSRF. Ingested content is sanitized.
- The AI step only writes summaries from public advisory text. It never sets urgency and never sees your code.
- You can export or delete all organization data at any time.