Security and Trust

PRCheck reads PR diffs only. We request the diff of changed files for each pull request event. We do not clone full repositories, read git history, fetch files outside the diff scope, or hold standing read access to your codebase between scan events.

This is enforced at the permission level: our GitHub App requests contents: read scoped to the diff for the PR event only. Once a scan completes, we do not retain the diff content.

We do not train on your code. Your PR diffs are never used to train, fine-tune, or update any model or analysis ruleset. This is a hard commitment, not a policy that might change with a Terms update. Our analysis engines are static-analysis based (AST + pattern matching), not LLM-based, so there is no training feedback loop to opt out of.

We treat your code as confidential data. It is processed in-flight for analysis purposes and then discarded.

Diff content is held in memory during analysis and purged within 60 seconds of scan completion. We do not write diff content to persistent storage at any point in the pipeline.

What we do retain: scan metadata (repo name, PR number, finding count, timestamp) for dashboard display and billing. This metadata does not include code content. Scan metadata is retained for 12 months and then deleted.

Account and billing data is retained per our standard data retention policy and applicable law.

All data in transit is encrypted using TLS 1.3. Our webhook endpoints enforce TLS 1.2 minimum. We do not accept unencrypted connections. Data at rest (scan metadata, account data) is encrypted using AES-256.

Access within PRCheck is role-based. Business plan customers can configure RBAC per their organization. Internally, we follow least-privilege principles: engineers have access only to the systems required for their work. Production database access requires MFA and is audited.

GitHub App permissions are scoped minimally: pull_requests: read, checks: write, contents: read. We do not request administrative, webhook management, or organization-level permissions.

We are building toward SOC 2 Type II. We are not currently certified. We expect to begin our Type II observation period in late 2026. We will update this page when certification is complete.

In the meantime, we are happy to share our security questionnaire responses for enterprise evaluations. Email [email protected].

If you discover a security vulnerability in PRCheck, please email [email protected] with the subject line "Security Disclosure". We will acknowledge receipt within 24 hours and work to resolve critical issues within 7 days.

We do not have a formal bug bounty program at this time. We appreciate good-faith disclosures and will credit researchers who report valid findings.