SECURITY
Your code, handled the way you'd handle it yourself.
Every claim on this page describes what the code actually does today, not a roadmap. Where we have not built something — SOC 2, SSO, a configurable-roles RBAC system — we say so instead of implying it.
Encrypted at rest
OAuth tokens, BYOK provider keys, and the code content Mapnostics indexes are all encrypted with AES-256-GCM before they reach the database. A database dump alone does not hand over usable credentials or readable source.
Read-only, by what the code does
Mapnostics connects to GitHub to read repositories, file contents, and commit history. Nothing in the codebase makes a write call to the GitHub API — no commits, no branches, no pushes.
Never used to train models
Code-derived data is processed by our AI providers to generate your analyses. Those providers are contractually prohibited from training models on your data.
Row-level isolation
Data is stored in managed Postgres, protected by row-level security so each account can only ever read its own data — enforced at the database layer, not just in application code.
Real deletion, not a flag
Deleting a repository or your account runs real, synchronous delete statements against every table that held its data. Not a soft-delete you have to trust will eventually run.
Questions about a specific requirement — compliance, deployment, or otherwise? Ask before you connect a repository, not after.
Talk to us →