Institutional memory for agentic infrastructure.Free
Connectory
Enterprise Security

Security & Compliance

Use this page to review available controls, pull-request data flow, and deployment options with the teams responsible for engineering risk.

SOC 2 Type II
AES-256 Encryption
Review Lifecycle Controls
Repository-Scoped Context
Self-Hosted Available

Data Flow Architecture

Code is processed in an isolated, stateless pipeline. Only review metadata is persisted, never your source code.

1

PR Created

GitHub webhook

2

Connectory Engine

In-memory processing

3

Policy Check

Rules & standards

4

AI Analysis

Isolated, stateless

5

Review Posted

PR comments

6

Audit Log

Metadata only

Steps 2-4: Code in memory only
Review lifecycle: Pull-request code moves through analysis and policy checks before the review result is posted back to GitHub.

Security Controls

Enterprise-grade controls designed for teams shipping to production in regulated environments.

SOC 2 Type II

Independently audited with continuous monitoring across security, availability, and confidentiality trust service criteria.

AES-256 Encryption at Rest

All persisted data encrypted with AES-256. API keys and tokens stored in isolated, hardware-backed vaults.

TLS 1.3 in Transit

All data transmitted over TLS 1.3 with forward secrecy. No plaintext communication at any layer.

Review Lifecycle

See how pull-request context moves from GitHub into a review and back. The privacy policy has the current data-handling details.

Repository Context

Connectory evaluates each pull request against the policies and patterns configured for that repository.

SSO / SAML / SCIM

Enterprise identity management with SAML 2.0 single sign-on and SCIM provisioning for automated user lifecycle.

RBAC & Least Privilege

Role-based access controls with principle of least privilege. Granular permissions per repository, team, and org.

Self-Hosted Deployment

Run Connectory entirely within your infrastructure. Full data sovereignty, no code ever leaves your network.

Compliance Framework Coverage

Connectory is designed to support your compliance posture across the major frameworks your legal and security teams care about.

SOC 2 Type II

Certified5 / 5 controls covered

Security (CC6)

Logical and physical access controls restrict unauthorized access to data and systems.

Availability (A1)

Availability commitments, monitoring responsibilities, and response paths are documented for the applicable plan.

Confidentiality (C1)

Confidential information is protected through encryption, access controls, and retention policies.

Processing Integrity (PI1)

System processing is complete, valid, and authorized, reviews are not altered in transit.

Privacy (P1)

Personal information is collected, used, retained, and disclosed in conformity with commitments.

Certified, independently auditedCompliant, requirements fully metAligned, controls in place, formal audit in progress

Production on AWS

Reliability you can plan around

Connectory runs production reviews and background workloads on AWS. Enterprise customers define service targets, support response, and recovery responsibilities during contracting and onboarding.

AWS production environment

Run production reviews and background workloads in Connectory's production AWS environment.

Service monitoring

Track review execution and background work so support teams can investigate failed or delayed jobs.

Recovery planning

Define the backup, restore, and recovery requirements that matter to your repositories and review process.

Escalation path

Document support contacts, response expectations, and incident ownership before launch.

Your service commitments

Enterprise plans turn reliability requirements into clear operating responsibilities for launch and support.

Uptime targets

Set the service target for your Enterprise plan in the customer agreement.

Support response

Agree on severity levels, response expectations, and the people to contact.

Recovery ownership

Record who coordinates recovery across Connectory, GitHub, AWS, and your team.

Incident Response

A structured, time-bound process ensures every security event is handled consistently, from the first alert to the final post-mortem.

0 min

Detection

Automated monitoring surfaces anomalous behaviour across infrastructure, application, and security telemetry streams.

< 15 min

Triage

On-call engineers classify incident severity, notify relevant teams, and open a dedicated incident channel.

< 1 hr

Containment

Affected systems are isolated to limit blast radius. Evidence is preserved for forensic analysis before remediation begins.

< 4 hr

Resolution

Root cause is identified, a targeted fix is developed and tested, then deployed through the standard change management pipeline.

< 48 hr

Post-Mortem

A blameless retrospective documents timeline, root cause, and corrective actions. Findings feed back into process improvement.

SLA Commitments

Critical
15-min response
High
1-hr response
Medium
4-hr response
Low
24-hr response

API Security

Every integration surface is hardened with authentication, traffic controls, and cryptographic verification.

Authentication

Industry-standard protocols protecting every API request from the first call.

  • OAuth 2.0 authorization framework
  • Overlapping API keys for uninterrupted rotation
  • JWT tokens with short expiry windows
  • PKCE flow support for public clients

Rate Limiting

Fair usage enforcement that protects platform stability for all tenants.

  • Per-endpoint configurable limits
  • Exponential backoff guidance in errors
  • Burst allowance for spiky workloads
  • 429 responses include Retry-After header

Webhook Security

Every outbound event is signed and verified so your systems only accept authentic payloads.

  • HMAC-SHA256 payload signatures
  • Timestamp validation prevents replay
  • Replay protection with nonce tracking
  • IP allowlisting for delivery endpoints
webhook-verify.ts
// Verify incoming webhook signature
import { createHmac, timingSafeEqual } from "crypto"

function verifyWebhookSignature(
  payload: string,
  signature: string,
  secret: string,
  timestamp: string,
): boolean {
  // Reject stale events (>5 min old)
  const age = Date.now() / 1000 - parseInt(timestamp, 10)
  if (age > 300) return false

  const expected = createHmac("sha256", secret)
    .update(`${timestamp}.${payload}`)
    .digest("hex")

  const sigBuffer = Buffer.from(signature.replace("sha256=", ""), "hex")
  const expBuffer = Buffer.from(expected, "hex")

  return timingSafeEqual(sigBuffer, expBuffer)
}

Timing-safe comparison prevents length-based timing attacks. All webhook deliveries include a X-Connectory-Signature and X-Connectory-Timestamp header.

Responsible Disclosure

We welcome security researchers who help make Connectory safer. If you discover a potential vulnerability, please report it privately so we can investigate and remediate before any public disclosure.

Scope

In scope

  • Connectory web platform (app.connectory.ai)
  • Public REST and GraphQL APIs
  • GitHub App and OAuth integration flows
  • Authentication and session handling
  • Data isolation and access control

Out of scope

  • Third-party services (GitHub, Stripe, AWS)
  • Social engineering or phishing attacks
  • Physical security or hardware
  • Denial-of-service (DoS/DDoS) testing
  • Vulnerabilities in out-of-date browser versions

Process

1

Report

Email security@connectory.ai with a clear description, reproduction steps, and any proof-of-concept. PGP encryption available on request.

2

Acknowledge

We confirm receipt within 24 hours and assign a tracking reference so you always know the status of your report.

3

Investigate

Our security team triages and validates the finding. We may reach out for clarification and will keep you updated throughout.

4

Fix & Disclose

Once resolved, we coordinate disclosure timing with you and publish a summary (where appropriate). You are credited by name or alias.

Contact

Send vulnerability reports to security@connectory.ai. We support PGP-encrypted submissions, request our public key in your initial message and we will provide it promptly.

Please include: affected component, reproduction steps, impact assessment, and any supporting screenshots or PoC code.

Recognition

We deeply appreciate the work of security researchers. Reporters of valid, in-scope vulnerabilities are publicly acknowledged in our security advisories, by full name, alias, or anonymously, according to your preference.

While we do not currently operate a paid bug-bounty programme, we recognise every researcher who helps us protect our customers.

Need a security review?

We work with enterprise security teams through procurement. Request our SOC 2 report, penetration test results, or schedule an architecture review.

Request Security DocumentationView Privacy Policy