# AI code review that passes an enterprise security review Rolling out an AI reviewer across hundreds of repositories raises questions a pilot never does: who can sign in, who can change settings, what the model sees, and how you prove what happened. This page answers them for MergeHarbor. [Start free trial](https://app.mergeharbor.com/signup) [Single sign-on and SCIM](https://mergeharbor.com/docs/sso) 14 days of the Team plan, no card needed. .mergeharbor.yml ``` # The organization can lock this policy # so repositories cannot weaken it. merge_gate: enabled: true mode: enforce preset: strict branches: - pattern: "release/*" preset: regulated ``` ## What MergeHarbor does Single sign-on and SCIM SAML 2.0 or OpenID Connect with Okta, Microsoft Entra ID, Google Workspace, Ping, Keycloak and others. Enforce SSO, restrict sign-in to verified domains, map groups to roles and teams, provision with SCIM 2.0, and keep up to five break-glass owners. Roles and permissions Owner, admin, member and viewer roles, plus custom roles built from granular permissions. Overriding a blocked merge gate, viewing costs and configuring security are separate permissions. A tamper-evident audit log Append-only, hash-chained records of every change, login and export, with integrity checks, CSV and JSONL export, and streaming to your SIEM. Compliance evidence Sealed evidence for every merged pull request, policies written as code and mapped to SOC 2, ISO 27001 and PCI DSS, and reports your auditor can test. Control over code and models Secrets are removed before any model sees them, customer code is never used for training, and you can restrict providers, model classes and US or EU inference regions, or self-host. One standard, locked where needed Organization defaults, repository overrides and .mergeharbor.yml, with settings an admin can lock so repositories cannot weaken them. The console shows every effective value and where it came from. ## A rollout that security teams can follow 1. ### Pilot on a few repositories Start a 14-day trial on active repositories with owners who will give feedback. Keep the merge gate in advisory mode. 2. ### Connect identity and policy Configure SSO and SCIM, map groups to roles, lock the settings that must not vary, and stream the audit log to your SIEM. 3. ### Expand and enforce Enable the rest of the estate, set budgets and per-pull-request caps, and switch the merge gate to enforce on the branches that need it. [Read the full single sign-on and SCIM](https://mergeharbor.com/docs/sso) ## What is in which plan

Every plan	Roles, API keys and the audit log; verification of every finding; status checks
Team and above	Merge gate, Deep review tier, issue triage
Advanced and above	Compliance evidence, security deep scans, Max review tier
Enterprise	SAML or OIDC SSO, SCIM, audit log streaming, custom roles, IP allowlists, locked settings, self-hosting, US or EU inference regions, an SLA
Certifications	MergeHarbor does not yet have a SOC 2 report; readiness work is under way and a Type I audit is planned

Documentation: [Single sign-on and SCIM](https://mergeharbor.com/docs/sso) [Code host permissions](https://mergeharbor.com/docs/permissions) [Compliance evidence](https://mergeharbor.com/docs/compliance) [How MergeHarbor uses AI and your code](https://mergeharbor.com/docs/ai-data) [Self-hosting](https://mergeharbor.com/docs/self-hosting) ## Further reading [Guide · 8 min read AI code review security and data privacy What an AI code reviewer sends to model providers, what it should never send, who keeps your code and for how long, and the questions to ask any vendor. Read the guide](https://mergeharbor.com/guides/security-and-data-privacy) [Guide · 8 min read What AI code review costs per developer How per-developer pricing and pooled review credits work, worked monthly cost examples for real team sizes, and the controls that keep the bill predictable. Read the guide](https://mergeharbor.com/guides/ai-code-review-cost-per-developer) ## Frequently asked questions Does MergeHarbor have a SOC 2 report? Not yet. MergeHarbor is built around controls aligned with SOC 2 and GDPR requirements, readiness work is under way, and a Type I audit is planned. The security page describes the controls in place today. Is our code used to train models? No. MergeHarbor does not train or fine-tune any model on customer code, pull request content or review results, and the model providers it uses do not train on API data under their commercial terms. Can MergeHarbor staff see our data? Not without your approval. In MergeHarbor Cloud, support access is a time-limited session, read-only by default, that an owner of your organization approves and can revoke, and every action is recorded in your audit log. Which plan includes single sign-on? Single sign-on (SAML 2.0 or OpenID Connect) and SCIM are part of the Enterprise plan and self-hosted deployments. They are not included in Essentials, Team, Advanced or the Team trial. Where is hosted data stored? MergeHarbor Cloud stores data in AWS Asia Pacific (Sydney), encrypted at rest. Enterprise organizations can restrict model inference to US or EU regions, and self-hosted installations keep everything in your own infrastructure. Do you offer an SLA? Enterprise agreements can include an uptime commitment with service credits and defined support response times. Contact sales for current terms. Have another question? [Talk to our team](https://mergeharbor.com/contact) ## Plan your enterprise rollout Talk to us about SSO, self-hosting, procurement and a security review, or start a 14-day trial of the Team plan on your own. [Contact sales](https://mergeharbor.com/contact?source=enterprise) [Start free trial](https://app.mergeharbor.com/signup)