Security and data
Stackat reads your infrastructure files, keeps only tool names, versions and where they are pinned, and never sends your code to an AI model. The short version is below; the full pages are linked at the end.
What the apps can do#
| App | Code | Issues | Pull requests |
|---|---|---|---|
| Stackpaw | Read and write (to push the bump branch) | Read and write | Read and write |
| Stackpaw Audit | Read only | Read and write | None |
Both apps only see the repositories you select and use no webhooks. Commands on issues count only from people with a role in the repository; see Commands.
What Stackat reads and keeps#
- Reads only infrastructure files (YAML, Terraform, HCL) at the latest commit, narrowed further by
scan. They are held in memory during the scan and gone when it finishes; application code stays on GitHub. - Keeps the scan result: tool names, versions, the file and line where each is pinned, the names of configuration keys you set and true/false switches. Never other values, never Kubernetes Secrets.
- Pseudonyms: organisation, repository and user names are replaced by keyed hashes everywhere Stackat stores, logs or shows them on its side.
- No AI on your data: the model only reads public release notes. Matching them to your files is plain code.
- Settings stay in your repository (
.stackat.yml), versioned and reviewable. A Slack webhook is kept encrypted; Jira needs no credentials at all. - Leaving: uninstall the app and Stackat stops at once; your organisation's data is deleted 90 days later, or at once on request.
The full pages#
- Security: how Stackat is protected, and how to report a vulnerability.
- What we collect: every item Stackat keeps about your organisation, and for how long.
- Privacy policy: personal data, legal bases, subprocessors and your rights.
- Data processing: the Data Processing Agreement that comes with every plan.