Trust Center
We handle your code metadata. Here is exactly what we do with it.
No source code stored. Dependency manifests and lockfiles only. Short-lived tokens. All data encrypted in transit and at rest.
What Repohelm reads from your repositories. And what it never touches.
What we access
- Dependency manifest files (package.json, go.mod, Cargo.toml, etc.)
- Lockfiles (package-lock.json, go.sum, etc.)
- Repository metadata (name, default branch, push events)
What we never access
- Source code content
- Secrets or environment variables
- Commit history beyond manifest files
- Read access to non-dependency files
Architecture overview
Push events trigger a webhook to Repohelm's receiver. We fetch only manifest and lockfile paths. Dependency metadata is evaluated against your policy. A fix PR is opened back to your repo. Source code never leaves your code host.
Built with compliance controls in mind
Repohelm is built with SOC 2 Type II controls in mind. We are not yet certified. The controls below are implemented today and available for audit on request.
Encryption in transit
TLS 1.3 for all API and webhook communication.
Encryption at rest
AES-256 for stored dependency metadata.
Token scope minimization
GitHub App tokens scoped to read:contents for manifest files only. Rotated on each workflow run.
Audit logging
Every scan, policy evaluation, and PR event logged with actor and timestamp.
Data residency
US-region data storage. Enterprise customers may request single-tenant deployment.