Data & Security
Last updated 24 August 2026.
Natural-person operator: Leo Duquesnel. Security contact: leo@bravoure.co. Production access is founder-only. The GitHub App publisher is unverified (a person, not a company). An organization owner may have to approve the App.
No SOC 2, ISO 27001, or independent penetration test yet. Do not treat this page as one.
Permissions
Repository: Metadata read, Actions read, Contents read. Account: Email addresses read.
GitHub grants Contents: read (full source across selected repos) and Actions: read (run metadata; logs and artifacts are also reachable under that permission class). Enforced behavior: path and endpoint allowlist; transient parse of default-branch workflow files under .github/workflows/ only; never call log or artifact download endpoints; persist derived data only. Necessity: without the workflow file you cannot tell a scheduled job from a manual one.
Email addresses: read is the GitHub App account permission used for the completion email. It is not an OAuth user:email scope. User-token scope is empty. A marked copy of that email also goes to leo@bravoure.co.
What is stored
GitHub identity (numeric user id, display name, avatar URL, primary verified email), sessions and Auth.js account rows with token columns left null, encrypted GitHub user authorization ciphertext, installation binding and account login, selected repository membership, audit runs, derived workflow observations (path, commit SHA, trigger class, run counts and conclusions, booleans for whether a workflow references secrets or declares OIDC), run-to-run comparison rows (workflow path, transition class, resolved flag, removal reason), coverage gaps, findings with repo and path parameters, email recipient address and delivery state, and webhook delivery ids. Never YAML, logs, artifacts, raw API bodies, secret values, secret names, installation tokens, OAuth codes, GitHub Cookie headers, or authorization headers. The app sets its own session cookie.
Subprocessors
Application database and email storage are in the United States.
- Vercel — application host, United States, production origin https://app.bravoure.co
- Neon — Postgres, aws-us-east-1. Point-in-time restore window is 6 hours.
- Resend — email, us-east-1, from send.bravoure.co. Open and click tracking off.
- GitHub — API access for the selected installation. Repositories stay on GitHub.
Retention
Audit rows: deleted within 90 days after an installation’s last run. Uninstall or delete clears audit runs and repository membership within 24 hours; the installation row is kept as a tombstone (installation id, account login, timestamps) so replayed webhooks can be rejected. Webhook delivery ids age out at 90 days. Identity rows — your user record and encrypted GitHub authorization — stay until you ask for deletion; email leo@bravoure.co. Revoking the GitHub authorization ends access and deletes sessions but does not by itself delete those rows. Neon PITR ages out on the 6-hour window. An hourly Vercel Cron job applies those deletion windows in production; calls without the cron secret are rejected. Vercel Workflows retains receipts (ids, counts, gap codes, rate facts), not observations, for 7 days after completion on Pro; uninstall cannot wipe that vendor log inside 24 hours. Resend keeps email content and metadata about 30 days on current plans; uninstall cannot wipe Resend inside 24 hours.
No sale of customer data. No use of customer data for model training. No model in the request path.
Installs are selected repositories, at most 50. Access is rechecked against GitHub when you finish setup, start a run, and open a report. The in-progress status poll does not call GitHub.