audit-labs/gh-attest

  1# gh-attest — Privacy Policy
  2
  3**Effective date:** 2026-07-19
  4
  5gh-attest ("the App") is a GitHub App operated by Audit Labs ("we",
  6"us"). It helps compliance and security teams collect
  7point-in-time evidence about the security configuration of their own
  8GitHub organization and map it to SOC 2 and ISO 27001 control
  9identifiers. This policy explains what the App processes, why, how long
 10it is kept, and your choices.
 11
 12This policy covers the gh-attest App and its dashboard only. It does not
 13cover GitHub itself — see GitHub's Privacy Statement for how GitHub
 14handles your data.
 15
 16## What we process
 17
 18The App processes data only for organizations that have installed it,
 19and only within the scope of the permissions granted at installation.
 20
 21**Organization & installation metadata.** Installation ID, organization
 22login, and installation/suspension timestamps. If you exclude repositories
 23from scanning, the App stores the excluded repository names for your
 24installation.
 25
 26**Security & access-control signals (the evidence).** As your
 27configuration changes and on a periodic re-sync, the App records
 28point-in-time "snapshots" of security-relevant state, which may include:
 29
 30- branch protection and repository ruleset configuration (enabled /
 31  disabled);
 32- repository, push, and member/team change events;
 33- Dependabot, code scanning, and secret scanning alert state.
 34
 35For audit-trail integrity, each snapshot stores the original GitHub
 36webhook payload that produced it. These payloads can contain repository
 37names, team names, and the GitHub logins of members whose access
 38changed.
 39
 40**Dashboard sign-in.** When you sign in to the dashboard, the App reads
 41your GitHub user ID and login and the list of installations you can
 42access, solely to confirm you belong to an organization that installed
 43the App. Your GitHub profile is stored only inside a signed, expiring
 44session cookie in your browser — it is **not** written to our database.
 45
 46**Exports.** Evidence exports you generate (CSV or PDF) are stored so
 47you can download them, along with metadata about each export job.
 48
 49## What we do NOT process
 50
 51- We do **not** store the contents of your source code.
 52- We do **not** store GitHub personal access tokens. The App
 53  authenticates using short-lived installation access tokens minted per
 54  request (valid ~1 hour) and never persisted.
 55- We do **not** collect passwords or payment information.
 56- We do **not** sell your data or share it with third parties for
 57  advertising, and we do **not** aggregate data across organizations.
 58
 59## How we use it
 60
 61Solely to provide the App's function: presenting your current security
 62posture, mapping it to SOC 2 / ISO 27001 controls, and generating
 63point-in-time evidence exports and access-review comparisons for your
 64own organization.
 65
 66## Where it is stored and how it is protected
 67
 68All data is stored on Cloudflare's platform (D1 and R2) in the
 69**European Union**. Both the database and the object storage are created
 70under Cloudflare's `eu` jurisdiction, which restricts them to storing and
 71running within the EU.
 72
 73Note that the application code itself runs on Cloudflare Workers, which
 74execute at the network edge close to the requesting user. A request made
 75from outside the EU is therefore processed outside the EU, even though
 76the data it reads and writes is stored within the EU. We do not currently
 77use Cloudflare's Regional Services to constrain where request processing
 78occurs.
 79
 80Protections include:
 81
 82- webhook payloads are verified with HMAC-SHA256 signatures before
 83  processing;
 84- the GitHub App private key, webhook secret, and session-signing key
 85  are stored as encrypted platform secrets, never in source code;
 86- authentication uses short-lived installation tokens that are never
 87  stored;
 88- all stored data is scoped per installation, and the dashboard enforces
 89  that a signed-in user can access only their own organization's data.
 90
 91## Subprocessors
 92
 93- **Cloudflare, Inc.** — hosting, database (D1), and object storage (R2),
 94  under the EU jurisdiction described above.
 95
 96**GitHub, Inc.** is the system the data comes from. Your organization has
 97its own relationship with GitHub, so GitHub is not a subprocessor we
 98engage on your behalf.
 99
100If we add or replace a subprocessor, we will notify installed
101organizations in advance so they have an opportunity to object.
102
103## Security incidents
104
105If we become aware of a breach affecting your organization's data, we
106will notify you without undue delay and provide the information you need
107to meet your own notification obligations.
108
109## Data retention & deletion
110
111Evidence snapshots are retained for 13 months, export files
112for 90 days, and all data for an organization is deleted when the App
113is uninstalled. You may also request deletion at any time.
114
115## Your choices and rights
116
117**If you administer an installing organization:**
118
119- **Uninstall** the App at any time from your organization's GitHub
120  settings to stop all processing and trigger deletion of your data.
121- **Exclude repositories** from scanning and reporting from the
122  dashboard, so the App stops collecting new evidence about them.
123- **Export** your organization's data as CSV or PDF from the dashboard
124  at any time.
125- **Request deletion** of your organization's data by contacting us.
126- Request a **Data Processing Addendum** if you need one for your own
127  compliance obligations.
128
129**If you are an individual whose GitHub login appears in an
130organization's data:** we hold that data on behalf of that organization,
131which decides how it is used. We have no direct relationship with you
132and cannot verify your identity, so please direct access, correction, or
133deletion requests to the organization. If you contact us, we will refer
134your request to them rather than acting on it ourselves.
135
136Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA), you may have
137additional rights; the organization can exercise them with our
138assistance.
139
140## Contact
141
142privacy@audit-labs.dev — Audit Labs
143
144## Changes
145
146We may update this policy. Material changes will be reflected by the
147effective date above and, where appropriate, communicated to installed
148organizations.