Skip to content
graphide
Try GraphideDashboard
DocsAccounts and access

Security and data

Accounts and access

How you sign in to Graphide, who can see a repository's data, and how Graphide staff reach your account.

Signing in

  • You sign in with GitHub, Google, Microsoft or your email address. Supabase runs sign-in, and Graphide never sees your password.
  • Signing up passes a Cloudflare Turnstile check, so Cloudflare sees your IP address and browser details for that check.
  • Graphide’s API accepts only tokens Supabase signed for a signed-in user. It checks each signature against Supabase’s published public keys, requires an expiry, and checks who issued the token and who it is for.

Coding agents sign in separately, through your browser: Review security has the details. Each one is listed under Connected agents on your dashboard, where you can sign it out.

Who can see a repository’s data

One rule decides who may use a repository in Graphide:

  • Owner: the Graphide account that the repository’s GitHub App installation is linked to, while that installation is not suspended.
  • User: another Graphide account, only while GitHub says its GitHub user is a collaborator on the repository. Graphide keeps a yes from GitHub for 5 minutes, and for up to 30 while GitHub cannot be reached.
  • Changing a repository’s settings needs the owner, or an owner of a Graphide organization the repository is shared with.

Reviews of public repositories are an exception: anyone with the link can read them (Review security).

Staff access

  • Graphide’s staff console needs a staff role, and a permission of its own for each kind of action.
  • Every change a staff member makes to someone’s account through the console is written to an audit log in the same database transaction as the change: who made it, when, and what it was before.
  • To see the service as you see it, a staff member can open a read-only view of your account for 15 minutes. Opening it is written to the audit log.
  • Opening one of your stored reviews in the console is written to an audit log too.

Your account

Your account holds your user ID, your email address and, if you sign in with GitHub, your GitHub user name and ID. How to have it deleted: Data, retention and deletion.

Something wrong or missing? Tell us on Discord or at hello@graphide.com.