Security overview

These pages are written for a security review. Each one states what is true of the service today. The Privacy Policy and the Terms are the binding documents.

Security leadership

Benjamin McIntyre, CTO, is responsible for Graphide’s security, including infrastructure security and incident response. Contact him at ben@graphide.net.

The pieces

Piece	What it does	Where it runs
The Graphide Review GitHub App	Graphide’s access to your repositories, for both products	GitHub
The Graphide API	Signs you in, serves your dashboard, receives GitHub’s webhooks	Azure VMs in West US
Graphide CI	Starts runners for your jobs and records how they ran	Azure, West US and West US 2
The review service	Runs reviews and posts them on GitHub	A private Azure VM in West US with no public address
Review sandboxes	One container per review, holding a clone of the repository	Azure, in the United States
Database and sign-in	Your account and your reviews	Supabase, in the United States

The service runs in the United States.

How your code moves

1. GitHub to Graphide. GitHub sends events (a pull request opened, a job queued) to the Graphide API. The API checks each one’s signature before it acts on it or passes it on, and the CI and review services check the signature again.
2. Graphide CI. GitHub hands a queued job to a single-use runner that Graphide registered with GitHub for your organization. The job runs on a machine of its own, which is destroyed when the job ends. The job’s log and result go to GitHub.
3. Graphide review. A sandbox clones the repository at the pull request with a token that can only read it. The model reads the code there, and its requests go to Anthropic through Graphide’s review service. The review service, not the sandbox, posts the review on GitHub.

CI security and Review security cover each product under the same headings: what it can access, where it runs, isolation, secrets, what we store, who can see it, deletion and third parties.

In transit

graphide.com and the API at api.graphide.com are served over HTTPS and send HSTS, so browsers keep to HTTPS. GitHub’s webhooks are checked with HMAC-SHA256 signatures before anything acts on them.

What we never do

We never train an AI model on your code or data, never sell it, and run no analytics on our website. Apart from agent signals, which say when your coding agents start work or are about to push, carry none of your code, prompts or conversations, and can be turned off, we collect no telemetry from your machines. The Privacy Policy says this in full.

What we do not have yet

Graphide has no SOC 2 report, no ISO 27001 certificate and no other formal security certification. We have not tested a restore of the production database.

Report a security problem

Write to security@graphide.com. Say what you found and how to reproduce it. The same address is in /.well-known/security.txt.

Questions about your data, and requests to have it deleted, go to privacy@graphide.com.