Skip to content
Log inStart free trial

For platform, security and compliance teams

AI code review that passes an enterprise security review

Rolling out an AI reviewer across hundreds of repositories raises questions a pilot never does: who can sign in, who can change settings, what the model sees, and how you prove what happened. This page answers them for MergeHarbor.

Start free trialSingle sign-on and SCIM

14 days of the Team plan, no card needed.

.mergeharbor.yml
# The organization can lock this policy# so repositories cannot weaken it.merge_gate: enabled: true mode: enforce preset: strict branches: - pattern: "release/*" preset: regulated

What MergeHarbor does

Single sign-on and SCIM
SAML 2.0 or OpenID Connect with Okta, Microsoft Entra ID, Google Workspace, Ping, Keycloak and others. Enforce SSO, restrict sign-in to verified domains, map groups to roles and teams, provision with SCIM 2.0, and keep up to five break-glass owners.
Roles and permissions
Owner, admin, member and viewer roles, plus custom roles built from granular permissions. Overriding a blocked merge gate, viewing costs and configuring security are separate permissions.
A tamper-evident audit log
Append-only, hash-chained records of every change, login and export, with integrity checks, CSV and JSONL export, and streaming to your SIEM.
Compliance evidence
Sealed evidence for every merged pull request, policies written as code and mapped to SOC 2, ISO 27001 and PCI DSS, and reports your auditor can test.
Control over code and models
Secrets are removed before any model sees them, customer code is never used for training, and you can restrict providers, model classes and US or EU inference regions, or self-host.
One standard, locked where needed
Organization defaults, repository overrides and .mergeharbor.yml, with settings an admin can lock so repositories cannot weaken them. The console shows every effective value and where it came from.

A rollout that security teams can follow

  1. Pilot on a few repositories

    Start a 14-day trial on active repositories with owners who will give feedback. Keep the merge gate in advisory mode.

  2. Connect identity and policy

    Configure SSO and SCIM, map groups to roles, lock the settings that must not vary, and stream the audit log to your SIEM.

  3. Expand and enforce

    Enable the rest of the estate, set budgets and per-pull-request caps, and switch the merge gate to enforce on the branches that need it.

Read the full single sign-on and SCIM

What is in which plan

Every planRoles, API keys and the audit log; verification of every finding; status checks
Team and aboveMerge gate, Deep review tier, issue triage
Advanced and aboveCompliance evidence, security deep scans, Max review tier
EnterpriseSAML or OIDC SSO, SCIM, audit log streaming, custom roles, IP allowlists, locked settings, self-hosting, US or EU inference regions, an SLA
CertificationsMergeHarbor does not yet have a SOC 2 report; readiness work is under way and a Type I audit is planned
Documentation:Single sign-on and SCIMCode host permissionsCompliance evidenceHow MergeHarbor uses AI and your codeSelf-hosting
Guide · 8 min readAI code review security and data privacyWhat an AI code reviewer sends to model providers, what it should never send, who keeps your code and for how long, and the questions to ask any vendor.Read the guide Guide · 8 min readWhat AI code review costs per developerHow per-developer pricing and pooled review credits work, worked monthly cost examples for real team sizes, and the controls that keep the bill predictable.Read the guide

Frequently asked questions

Does MergeHarbor have a SOC 2 report?

Not yet. MergeHarbor is built around controls aligned with SOC 2 and GDPR requirements, readiness work is under way, and a Type I audit is planned. The security page describes the controls in place today.

Is our code used to train models?

No. MergeHarbor does not train or fine-tune any model on customer code, pull request content or review results, and the model providers it uses do not train on API data under their commercial terms.

Can MergeHarbor staff see our data?

Not without your approval. In MergeHarbor Cloud, support access is a time-limited session, read-only by default, that an owner of your organization approves and can revoke, and every action is recorded in your audit log.

Which plan includes single sign-on?

Single sign-on (SAML 2.0 or OpenID Connect) and SCIM are part of the Enterprise plan and self-hosted deployments. They are not included in Essentials, Team, Advanced or the Team trial.

Where is hosted data stored?

MergeHarbor Cloud stores data in AWS Asia Pacific (Sydney), encrypted at rest. Enterprise organizations can restrict model inference to US or EU regions, and self-hosted installations keep everything in your own infrastructure.

Do you offer an SLA?

Enterprise agreements can include an uptime commitment with service credits and defined support response times. Contact sales for current terms.

Have another question? Talk to our team

Plan your enterprise rollout

Talk to us about SSO, self-hosting, procurement and a security review, or start a 14-day trial of the Team plan on your own.

Contact salesStart free trial