91% of developers use AI tools. Your repo is accumulating technical debt RIGHT NOW.

Connectory
Enterprise Security

Security & Compliance

Built for teams that ship to regulated environments. Your code is processed securely, never stored, and never used to train models.

SOC 2 Type II
AES-256 Encryption
Zero Code Storage
No Model Training
Self-Hosted Available

Data Flow Architecture

Code is processed in an isolated, stateless pipeline. Only review metadata is persisted — never your source code.

1

PR Created

GitHub webhook

2

Connectory Engine

In-memory processing

3

Policy Check

Rules & standards

4

AI Analysis

Isolated, stateless

5

Review Posted

PR comments

6

Audit Log

Metadata only

Steps 2-4: Code in memory only
Key guarantee: Source code exists only in Steps 2-4, processed in memory with no disk writes. After the review is posted, all code data is discarded.

Security Controls

Enterprise-grade controls designed for teams shipping to production in regulated environments.

SOC 2 Type II

Independently audited with continuous monitoring across security, availability, and confidentiality trust service criteria.

AES-256 Encryption at Rest

All persisted data encrypted with AES-256. API keys and tokens stored in isolated, hardware-backed vaults.

TLS 1.3 in Transit

All data transmitted over TLS 1.3 with forward secrecy. No plaintext communication at any layer.

Zero Code Storage

Source code is processed in memory during reviews and discarded immediately. No code is persisted to disk or databases.

No Model Training

Your code is never used to train AI models. Repository learnings are stored as abstract patterns, never raw code.

SSO / SAML / SCIM

Enterprise identity management with SAML 2.0 single sign-on and SCIM provisioning for automated user lifecycle.

RBAC & Least Privilege

Role-based access controls with principle of least privilege. Granular permissions per repository, team, and org.

Self-Hosted Deployment

Run Connectory entirely within your infrastructure. Full data sovereignty — no code ever leaves your network.

Compliance Framework Coverage

Connectory is designed to support your compliance posture across the major frameworks your legal and security teams care about.

SOC 2 Type II

Certified5 / 5 controls covered

Security (CC6)

Logical and physical access controls restrict unauthorized access to data and systems.

Availability (A1)

System availability commitments and SLA obligations are met with 99.9% uptime.

Confidentiality (C1)

Confidential information is protected through encryption, access controls, and retention policies.

Processing Integrity (PI1)

System processing is complete, valid, and authorized — reviews are not altered in transit.

Privacy (P1)

Personal information is collected, used, retained, and disclosed in conformity with commitments.

Certified — independently auditedCompliant — requirements fully metAligned — controls in place, formal audit in progress

Global Infrastructure & Reliability

Connectory runs across three geographically distributed regions with automatic failover and a contractual 99.9% uptime SLA.

Active regions

operational

US-East

Virginia, USA

Primary
operational

US-West

Oregon, USA

operational

EU-West

Dublin, Ireland

Redundancy & Recovery

Multi-AZ deployment

Each region spans multiple availability zones for fault isolation.

Automated failover

Health checks trigger automatic traffic rerouting within seconds.

Daily backups

Automated snapshots retained for 30 days with point-in-time restore.

RPO < 1 hour

Recovery Point Objective under 1 hour for all data stores.

0.0%

Uptime SLA

Contractual uptime guarantee backed by redundant multi-region infrastructure.

99.97%

Avg. uptime (12 mo)

0 P0

Incidents (12 mo)

Incident Response

A structured, time-bound process ensures every security event is handled consistently — from the first alert to the final post-mortem.

0 min

Detection

Automated monitoring surfaces anomalous behaviour across infrastructure, application, and security telemetry streams.

< 15 min

Triage

On-call engineers classify incident severity, notify relevant teams, and open a dedicated incident channel.

< 1 hr

Containment

Affected systems are isolated to limit blast radius. Evidence is preserved for forensic analysis before remediation begins.

< 4 hr

Resolution

Root cause is identified, a targeted fix is developed and tested, then deployed through the standard change management pipeline.

< 48 hr

Post-Mortem

A blameless retrospective documents timeline, root cause, and corrective actions. Findings feed back into process improvement.

SLA Commitments

Critical
15-min response
High
1-hr response
Medium
4-hr response
Low
24-hr response

API Security

Every integration surface is hardened with authentication, traffic controls, and cryptographic verification.

Authentication

Industry-standard protocols protecting every API request from the first call.

  • OAuth 2.0 authorization framework
  • API key rotation with zero downtime
  • JWT tokens with short expiry windows
  • PKCE flow support for public clients

Rate Limiting

Fair usage enforcement that protects platform stability for all tenants.

  • Per-endpoint configurable limits
  • Exponential backoff guidance in errors
  • Burst allowance for spiky workloads
  • 429 responses include Retry-After header

Webhook Security

Every outbound event is signed and verified so your systems only accept authentic payloads.

  • HMAC-SHA256 payload signatures
  • Timestamp validation prevents replay
  • Replay protection with nonce tracking
  • IP allowlisting for delivery endpoints
webhook-verify.ts
// Verify incoming webhook signature
import { createHmac, timingSafeEqual } from "crypto"

function verifyWebhookSignature(
  payload: string,
  signature: string,
  secret: string,
  timestamp: string,
): boolean {
  // Reject stale events (>5 min old)
  const age = Date.now() / 1000 - parseInt(timestamp, 10)
  if (age > 300) return false

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${payload}`)
    .digest("hex")

  const sigBuffer = Buffer.from(signature.replace("sha256=", ""), "hex")
  const expBuffer = Buffer.from(expected, "hex")

  return timingSafeEqual(sigBuffer, expBuffer)
}

Timing-safe comparison prevents length-based timing attacks. All webhook deliveries include a X-Connectory-Signature and X-Connectory-Timestamp header.

Responsible Disclosure

We welcome security researchers who help make Connectory safer. If you discover a potential vulnerability, please report it privately so we can investigate and remediate before any public disclosure.

Scope

In scope

  • Connectory web platform (app.connectory.ai)
  • Public REST and GraphQL APIs
  • GitHub App and OAuth integration flows
  • Authentication and session handling
  • Data isolation and access control

Out of scope

  • Third-party services (GitHub, Stripe, AWS)
  • Social engineering or phishing attacks
  • Physical security or hardware
  • Denial-of-service (DoS/DDoS) testing
  • Vulnerabilities in out-of-date browser versions

Process

1

Report

Email security@connectory.ai with a clear description, reproduction steps, and any proof-of-concept. PGP encryption available on request.

2

Acknowledge

We confirm receipt within 24 hours and assign a tracking reference so you always know the status of your report.

3

Investigate

Our security team triages and validates the finding. We may reach out for clarification and will keep you updated throughout.

4

Fix & Disclose

Once resolved, we coordinate disclosure timing with you and publish a summary (where appropriate). You are credited by name or alias.

Contact

Send vulnerability reports to security@connectory.ai. We support PGP-encrypted submissions — request our public key in your initial message and we will provide it promptly.

Please include: affected component, reproduction steps, impact assessment, and any supporting screenshots or PoC code.

Recognition

We deeply appreciate the work of security researchers. Reporters of valid, in-scope vulnerabilities are publicly acknowledged in our security advisories — by full name, alias, or anonymously, according to your preference.

While we do not currently operate a paid bug-bounty programme, we recognise every researcher who helps us protect our customers.

Need a security review?

We work with enterprise security teams through procurement. Request our SOC 2 report, penetration test results, or schedule an architecture review.

Request Security DocumentationView Privacy Policy