Security

Compliance

We do not hold SOC 2 or ISO 27001 yet. We plan a SOC 2 audit as we grow. This page describes the controls we use today, and we will update it when that changes.

GitHub access

The Heimdl GitHub App sees only the repositories you install it on, and asks for these permissions. It can read your code but cannot push to it, and it has no access to secrets, settings or administration.

It receives these events: check runs, pull requests, pull request comments and review comments.

You choose which repositories Heimdl can see, and you can remove its access at any time from your GitHub settings.

Where and how checks run

Each check runs in its own containers on a Google Cloud machine. The containers are created for that check and removed afterwards. A machine runs at most two checks at a time, each in its own containers. Your tests have outbound internet access, as in CI, and cannot reach the cloud metadata service. Private repositories are copied with your GitHub App installation's credentials, which last at most one hour, cover only that installation and never enter the containers that run your tests.

Heimdl does not collect your secrets, API keys or CI variables: there is no place to give them to us. Heimdl's own credentials are kept in Google Secret Manager.

When a run ends

When a check ends, whether it succeeds, fails or times out, its containers and the copy of your repository are deleted. We do not keep a copy of your source files. To make later checks faster, dependency and build caches, which can contain compiled code, are kept separately for each GitHub App installation and deleted 30 days after you uninstall.

What we keep

After a check we keep its results: run and repository identifiers, the pull request's number, title and author, the commit checked, timings and cost, and for each finding its file path and line, outcome, which tests ran and their names, severity and impact. For 30 days we also keep the code the check involved: the changed lines, the changes Heimdl made, suggested test source, test output and report text that quotes code. Then that code is deleted and the findings stay.

AI models

We send a model only what its step needs. Code reviewed by Heimdl (checks, test generation, severity and review models) is processed with zero data retention and never used for training. Repository setup, a one-time step at onboarding, uses an AI provider under its standard commercial terms: what it receives is kept for up to 30 days and is not used for training.

We never train AI models on your code, and neither do the model providers we use.

AI models are part of every check. They cannot be switched off for an account.

Monitoring

We monitor checks with our own run records and Google Cloud logging, which keep no code or prompts beyond what our Privacy Policy already lists.

Subprocessors and DPA

The service providers that process customer data, what each receives and where, are listed on our subprocessors page. Polar handles payments as merchant of record and receives billing details, not your code.

A data processing agreement (DPA) is available on request at hello@heimdl.ai.

Data retention

Code stored with a check is deleted 30 days after the check; its findings stay. Everything else about a repository (checks, findings, feedback, comments and caches) is deleted 30 days after you uninstall the GitHub App or remove the repository. Deletion requests are completed within 30 days. Deleted data leaves our database backups within 7 more days. Billing and tax records are kept as the law requires.

Encryption and access

Data is encrypted in transit (TLS) and at rest (Google Cloud default encryption). Only Heimdl's founders can access production systems. We store only one way hashes of the API tokens we issue.

Logging and backups

Administrative access to our Google Cloud project is recorded in Google Cloud audit logs.

Our database is backed up daily on Google Cloud, and each backup is kept for 7 days, so data we delete leaves our backups within 7 days.

Security incidents

If we become aware of a security incident affecting your data, we will tell affected account owners by email without undue delay, and within 72 hours of confirming a breach affecting their data, consistent with the GDPR. We explain what happened and what we are doing about it, and keep you updated. Where we are the controller and the law requires it, we also notify the relevant authorities and affected people.

Your part

Security is shared. Install the GitHub App only on repositories Heimdl needs, protect your GitHub organisation with two factor authentication and branch protection, keep secrets out of your repositories, revoke Heimdl tokens you no longer use, and review every suggested test before you merge it.

Reporting a security issue

Email security@heimdl.ai with "Security" in the subject. We acknowledge reports within 2 business days and keep you updated until the issue is fixed.

Please give us reasonable time to fix an issue before you disclose it, and do not access other customers' data or disrupt the service while testing. We will not pursue good faith research that follows these rules.