audit-labs/gh-attest

  1# gh-attest — Privacy Policy
  2
  3**Effective date:** 2026-07-19
  4
  5gh-attest ("the App") is a GitHub App operated by Audit Labs ("we",
  6"us"). It helps compliance and security teams collect
  7point-in-time evidence about the security configuration of their own
  8GitHub organization and map it to SOC 2 and ISO 27001 control
  9identifiers. This policy explains what the App processes, why, how long
 10it is kept, and your choices.
 11
 12This policy covers the gh-attest App and its dashboard only. It does not
 13cover GitHub itself — see GitHub's Privacy Statement for how GitHub
 14handles your data.
 15
 16## What we process
 17
 18The App processes data only for organizations that have installed it,
 19and only within the scope of the permissions granted at installation.
 20
 21**Organization & installation metadata.** Installation ID, organization
 22login, and installation/suspension timestamps.
 23
 24**Security & access-control signals (the evidence).** As your
 25configuration changes and on a periodic re-sync, the App records
 26point-in-time "snapshots" of security-relevant state, which may include:
 27
 28- branch protection and repository ruleset configuration (enabled /
 29  disabled);
 30- repository, push, and member/team change events;
 31- Dependabot, code scanning, and secret scanning alert state.
 32
 33For audit-trail integrity, each snapshot stores the original GitHub
 34webhook payload that produced it. These payloads can contain repository
 35names, team names, and the GitHub logins of members whose access
 36changed.
 37
 38**Dashboard sign-in.** When you sign in to the dashboard, the App reads
 39your GitHub user ID and login and the list of installations you can
 40access, solely to confirm you belong to an organization that installed
 41the App. Your GitHub profile is stored only inside a signed, expiring
 42session cookie in your browser — it is **not** written to our database.
 43
 44**Exports.** Evidence exports you generate (CSV or PDF) are stored so
 45you can download them, along with metadata about each export job.
 46
 47## What we do NOT process
 48
 49- We do **not** store the contents of your source code.
 50- We do **not** store GitHub personal access tokens. The App
 51  authenticates using short-lived installation access tokens minted per
 52  request (valid ~1 hour) and never persisted.
 53- We do **not** collect passwords or payment information.
 54- We do **not** sell your data or share it with third parties for
 55  advertising, and we do **not** aggregate data across organizations.
 56
 57## How we use it
 58
 59Solely to provide the App's function: presenting your current security
 60posture, mapping it to SOC 2 / ISO 27001 controls, and generating
 61point-in-time evidence exports and access-review comparisons for your
 62own organization.
 63
 64## Where it is stored and how it is protected
 65
 66All data is stored on Cloudflare's platform (D1 and R2) in the
 67**European Union**. Both the database and the object storage are created
 68under Cloudflare's `eu` jurisdiction, which restricts them to storing and
 69running within the EU.
 70
 71Note that the application code itself runs on Cloudflare Workers, which
 72execute at the network edge close to the requesting user. A request made
 73from outside the EU is therefore processed outside the EU, even though
 74the data it reads and writes is stored within the EU. We do not currently
 75use Cloudflare's Regional Services to constrain where request processing
 76occurs.
 77
 78Protections include:
 79
 80- webhook payloads are verified with HMAC-SHA256 signatures before
 81  processing;
 82- the GitHub App private key, webhook secret, and session-signing key
 83  are stored as encrypted platform secrets, never in source code;
 84- authentication uses short-lived installation tokens that are never
 85  stored;
 86- all stored data is scoped per installation, and the dashboard enforces
 87  that a signed-in user can access only their own organization's data.
 88
 89## Subprocessors
 90
 91- **Cloudflare, Inc.** — hosting, database (D1), and object storage (R2),
 92  under the EU jurisdiction described above.
 93
 94**GitHub, Inc.** is the system the data comes from. Your organization has
 95its own relationship with GitHub, so GitHub is not a subprocessor we
 96engage on your behalf.
 97
 98If we add or replace a subprocessor, we will notify installed
 99organizations in advance so they have an opportunity to object.
100
101## Security incidents
102
103If we become aware of a breach affecting your organization's data, we
104will notify you without undue delay and provide the information you need
105to meet your own notification obligations.
106
107## Data retention & deletion
108
109Evidence snapshots are retained for 13 months, export files
110for 90 days, and all data for an organization is deleted when the App
111is uninstalled. You may also request deletion at any time.
112
113## Your choices and rights
114
115**If you administer an installing organization:**
116
117- **Uninstall** the App at any time from your organization's GitHub
118  settings to stop all processing and trigger deletion of your data.
119- **Export** your organization's data as CSV or PDF from the dashboard
120  at any time.
121- **Request deletion** of your organization's data by contacting us.
122- Request a **Data Processing Addendum** if you need one for your own
123  compliance obligations.
124
125**If you are an individual whose GitHub login appears in an
126organization's data:** we hold that data on behalf of that organization,
127which decides how it is used. We have no direct relationship with you
128and cannot verify your identity, so please direct access, correction, or
129deletion requests to the organization. If you contact us, we will refer
130your request to them rather than acting on it ourselves.
131
132Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA), you may have
133additional rights; the organization can exercise them with our
134assistance.
135
136## Contact
137
138privacy@audit-labs.dev — Audit Labs
139
140## Changes
141
142We may update this policy. Material changes will be reflected by the
143effective date above and, where appropriate, communicated to installed
144organizations.