Platform configuration
Projects, components, networks, storage and machine sizing — the description of what should be built.
Data Processing Agreement
What we hold, and what we deliberately do not.
A platform that deploys your software does not need to read it. The distinction between orchestrating a deployment and holding the thing being deployed is one we intend to keep sharp.
Your source code stays yours
The platform does not clone, read, or store your repositories.
It holds a repository address and a credential that lets a pipeline reach it, and the pipeline runs against your infrastructure. What we keep is the configuration describing what should exist, not the application that ends up running.
What we do process
Infrastructure observations
What the target reports back: inventory and metrics summaries, used to show state and decide whether a deployment can proceed.
Account and identity
Sign-in identity, contact details, and the profiles attached to each project.
Actions taken
An audit record of infrastructure changes, including which user made them. This is personal data and will be treated as such.
Credentials, and the honest limit of encrypting them
Credentials you entrust to the platform — access tokens, provider passwords, runner tokens — are encrypted at rest with AES-256-GCM. Each stored value is bound to the field it belongs to, so a value lifted from one place cannot be replayed into another.
What that protects against, stated precisely: a database dump, a leaked backup, a replica an operator can read, and a database-level read through an application flaw.
What it does not protect against is compromise of the running application, which necessarily holds the key while it works. No encryption at this layer could, and we would rather say so than imply a guarantee the design cannot give. Defence there rests on access control, isolation and key rotation instead.
Sub-processors
Delivering the platform means other providers process some of this data. The intended list, to be kept current as an obligation rather than a courtesy:
- GitLab — pipelines, runners, deployment state and the role catalog.
- Vercel — hosting for the control plane.
- Autumn and Stripe — subscription billing and payment.
- Resend — transactional email.
- Google and GitHub — optional sign-in, for users who choose them.
- Our database host — the platform's primary datastore.
Still to be settled
Retention periods, the process for answering a data subject request, and the controller and processor identities are not yet fixed. They will be settled with counsel, and the software will be built to honour them — rather than the agreement being written to describe whatever the software happens to do.