Security at CodeStax
Full repository checkouts are processed ephemerally. Source-derived review evidence can be retained, sensitive credentials are encrypted, and optional AI processing follows the organization's selected provider policy and contract.
Full repository checkouts are removed after processing. PR diff patches and source-derived security evidence may remain at rest so authorized teams can inspect current and historical review results.
Code Processing
- Full repository checkouts use isolated scan workspaces and are removed after processing
- PR review attempts retain changed-file names and unified diff patches to render historical evidence
- Findings, summaries, review evidence, and source-derived records are tenant-scoped and retained under product controls
- When PR-review AI is enabled, bounded context is sent only to the provider selected by the effective policy and remains subject to that provider contract
Encryption
- Public platform traffic is protected in transit with HTTPS
- Sensitive data (OAuth tokens, API keys) encrypted at rest
- Stored credentials encrypted at rest
- Database and cache access between platform nodes uses private WireGuard network paths in the documented deployment
Authentication & Access
- Multi-provider OAuth (GitHub, Google, GitLab, Bitbucket, Azure AD)
- Role-based access control: Owner, Admin, Member, Viewer
- Organization-level tenant isolation on every database query
- API key authentication with per-key scoping and rotation
- Optional 2FA enforcement per organization
Infrastructure
- Private app-to-scanner and scanner-to-data paths use an encrypted WireGuard network
- Scanner workers run on a dedicated scanner server; repository fetches, package lookups, vulnerability intelligence, and configured AI provider calls stay isolated to scanner workloads
- Repository workspaces are removed after each scan; retained results and PR evidence use the platform data stores
- Per-IP rate limiting with sliding-window throttling
- Host-level Nginx with Let's Encrypt SSL (auto-renewed)
Monitoring & Audit
- Customer-visible audit events are recorded for implemented auth, API key, repository, scan, triage, settings, billing, compliance, and PR-review actions
- Scan execution and operational health are visible in product and admin views
- Structured operational logs use request or correlation metadata where implemented; credential and prompt values are not intentionally logged
- Operational logs and status views support investigation of security-relevant failures
Compliance
- SOC 2 Type II is on our roadmap
- GDPR & CCPA data-subject controls: export, deletion (30-day grace period), and anonymization
- CCPA data-subject controls: right to know, right to delete, no data sales
- Cookie consent — essential cookies only, no advertising or tracking
- Scan-data retention follows plan limits or configured organization SCA retention policies where enabled
- Compliance reports (SOC 2, ISO 27001, OWASP, PCI DSS) generated from your scan data
Have security questions?
Reach out to our security team at security@codestax.co or request a security overview.