Your source code is your most sensitive asset. We treat it that way.

Architecture and deployment

Deployment options

MergeHarbor cloud, or self-hosted on Kubernetes (Helm) or AWS (Terraform). Self-hosted installations run entirely in your environment.

Isolation

Every request is scoped to one organization in the same query that loads it. Users and API keys from other organizations receive “not found”, so organization existence is not disclosed.

Data plane

Repository indexes live in independent cells. Workers keep repository mirrors on local disk and evict them under a disk quota.

Review agent

The review agent can only read the repository and commit it was asked to review, through short-lived signed tokens.

Data handling

Secret redaction

API keys, tokens, private keys, JWTs, passwords in connection strings, and high-entropy secret assignments are removed before content reaches a model, logs, or archives.

No model training

Customer code is never used to train models. Self-hosted customers can use their own model provider accounts.

Encryption

TLS 1.2+ in transit, with optional mutual TLS between internal services. Code-host tokens and identity-provider secrets are encrypted at rest with AES-256-GCM and rotatable keys.

Retention

Organizations set a retention period for reviews, findings, and usage records. Deleted organizations are purged after a grace period.

Data residency

Organizations can restrict inference to a region and to approved model providers.

Data portability

Owners and admins can export the whole organization as JSON Lines at any time, through a signed link that expires after 15 minutes.

Payments

Card details are entered only on our payment provider's hosted pages. MergeHarbor never receives or stores card data.

Identity and access

Single sign-on

OpenID Connect with PKCE. Organizations can enforce SSO, restrict sign-in to their domains, and map identity-provider groups to roles.

Roles

Built-in owner, admin, member, and viewer roles, and custom roles. Users can only grant permissions they hold, and an organization always keeps an owner.

Sessions and API keys

Sessions and API keys are stored only as keyed hashes. API keys are scoped to one organization and role, with optional expiry.

Network policy

Per-organization IP allowlists and session lifetimes. Authentication endpoints are rate-limited.

Support access

MergeHarbor staff have no standing access to your organization in our cloud. Support requests a time-limited session, read-only by default, that an organization owner must approve and can revoke; every action is recorded in your audit log under the staff member's name.

Audit and monitoring

Audit log

Every change, sign-in, permission denial, and export is recorded with actor, IP address, and before-and-after values, with secrets masked.

Tamper evidence

Audit records are append-only and hash-chained per organization, so modified, deleted, or reordered records are detectable.

Integrity check

Owners can verify the hash chain from the console at any time; the result shows how many events were checked and the first one that does not match, if any.

SIEM streaming

Push audit events continuously to an HTTPS endpoint (HMAC-signed), Splunk HTTP Event Collector, Datadog Logs, or an Amazon S3 bucket, with retries and a delivery cursor. Export as CSV or JSONL at any time.

Operations

Prometheus metrics, OpenTelemetry tracing, and readiness checks on every service for self-hosted installations.

Code-host integrations

Least privilege

MergeHarbor requests only the permissions it needs to read code and post reviews on each code host.

Verified webhooks

Every webhook is authenticated with the host's signature or token, and replayed deliveries are ignored.

Self-managed hosts

Calls to customer-supplied hosts are restricted to HTTPS, re-checked after DNS resolution, and blocked from internal and cloud-metadata addresses unless you allow private networks.

Review integrity

Review configuration is read from the pull request's merge base, so a pull request cannot change how it is reviewed. Text that attempts to steer the reviewer is flagged.

Compliance

MergeHarbor is built around controls aligned with SOC 2 and GDPR requirements: access control, audit logging, encryption, retention, and vendor data-processing terms. MergeHarbor is not yet SOC 2 certified; an audit is planned. We provide a data processing addendum, a list of subprocessors, and completed security questionnaires on request.

Responsible disclosure