Security
Your code stays with you
Security is built into how Gitrevio works. Gitrevio does not need access to your source code. When you use LocalGit, code analysis runs on your own infrastructure, and Gitrevio receives the engineering data needed for analysis, not the source code itself. We also keep customer data separated, use minimal permissions, and protect credentials and API keys with encryption. Our security practices are supported by an ISMS and a dedicated security officer.
Your servers
Gitrevio receives
How LocalGit works
Your source code stays on your infrastructure
Most engineering analytics tools need access to your source code. Gitrevio doesn't. LocalGit is a lightweight agent that runs on your infrastructure. It analyzes your code locally and sends only the metadata needed by Gitrevio. This means your source code does not need to be uploaded to Gitrevio for code analysis.
What stays with you
What we receive
Customer data stays separated
Separate tenants for every customer
Gitrevio keeps customer data separated using dedicated database roles and customer-specific database access. Each customer has separate writer and reader roles, with access scoped to that customer's data. This separation is enforced at the database level, rather than relying only on application code.
Minimal permissions
We only ask for the access we need
Gitrevio uses read-only Personal Access Tokens for your git hosting and issue-tracking tools. We don't ask for write permissions when connecting these systems. This limits what Gitrevio can do with your connected tools and reduces the impact of a compromised credential.
Encryption
Encryption in transit
Data sent between your systems and Gitrevio is protected using TLS. Gitrevio supports TLS 1.3 and TLS 1.2, with TLS 1.3 preferred.
Encryption at rest
Sensitive customer credentials are encrypted using AES-256-GCM. Database storage is also protected using encryption provided by the underlying infrastructure.
API key protection
API keys are stored as SHA-256 hashes. The plain-text key is shown only when it is created and cannot be recovered later. If a key needs to be replaced, create a new one rather than trying to recover the old key.
Access and roles
Access is limited by role
Gitrevio uses separate database roles for different types of access. Customer reader roles are used for read-only access to customer-scoped data. Administrative access is limited to the processes that need it. This helps keep access to customer data narrow and controlled.
Audit and monitoring
We keep track of important activity
Gitrevio records audit information for supported API and MCP activity, with sensitive information removed from logged parameters where applicable. Our audit coverage is continuously reviewed and improved. For customers that need their own security monitoring, Gitrevio also provides audit log export options.
Your data, your control
Know what data we have
You can ask Gitrevio what data we hold from your organization. If you want your data removed, you can ask us to delete it. We believe customers should have a clear understanding of what data is stored and control over what happens to it.
Security for your organization
Built for teams that take security seriously
Gitrevio is designed to reduce the amount of access required to your engineering systems.
If your security or procurement team has specific requirements, talk to us about your organization's needs.
- Your source code can stay on your infrastructure with LocalGit.
- Customer data is separated between tenants.
- Git integrations use read-only permissions.
- Sensitive credentials are encrypted.
- API keys are stored as hashes.
- Database access is separated by role.
- Security practices are managed through our ISMS and security officer.
- Audit information is available for supported activity.