Sign in
Install the GitHub App (opens in a new tab)

Security

Last updated: October 30, 2026

Striff reads your pull requests to show what changed in your architecture and to check the change against your documentation. This page says what Striff reads, what it keeps, who else processes it, and how it is protected. If your security team needs more, email hi@haditechnology.com. We will fill in your security questionnaire, sign our Data Processing Agreement, and walk your team through how Striff works.

What Striff reads

Striff only reads repositories you chose when you installed the Striff GitHub App. When a pull request is opened or updated, Striff downloads the repository at the pull request's base revision and the files the pull request changed. It parses the changed files and the files they reference, and reads the repository's documentation: READMEs, architecture documents, decision records, and instruction files written for coding agents.

What we keep, and what we don't

Source code is not kept. Repository files are held in temporary storage on the analysis server while an analysis runs, and deleted when it ends. A scheduled sweep removes anything an interrupted analysis left behind. Source code is never written to our database.

What we keep:

  • Analysis results. Diagrams of the change, the names of the types and members involved and how they relate, and review findings.
  • Rules from your documentation, with the sentences they were read from.
  • Pull request details. Repository name, pull request number, commit identifiers, and the GitHub usernames of pull request authors.
  • Account and billing details. GitHub username, account ID, email address, organization membership, plan, and subscription status. Card details are held by Stripe and never reach us.

AI processing

Striff uses a large language model to turn documentation into rules, and to double-check a possible violation before reporting it. The model receives:

  • documentation text,
  • structural facts about the change: type and member names and how they relate,
  • when it checks a possible violation, short excerpts of the source files involved.

The model is DeepSeek V4 Flash, an open-weights model. Requests go through OpenRouter to an allow-list of three inference hosts, all operated by US companies: Parasail, Crusoe, and DeepInfra. Every host on the list is on OpenRouter's zero-data-retention list, so it does not store prompts or responses. Striff never sends anything to DeepSeek's own servers.

Your code and documentation are never used to train AI models.

GitHub App permissions

Permission Access Why
Contents Read Download the revisions of a pull request and read your documentation.
Pull requests Read and write Read a pull request's changed files, and post Striff's summary comment.
Checks Read and write Post Striff's result as a check run on the pull request.
Issues Read Show whether an issue opened from a Striff finding is open or closed.
Members Read Show your organization's dashboard only to its members.
Email addresses Read Contact you about your account and billing.
Metadata Read Required by GitHub for every App.

Striff has no write access to your code. Uninstalling the App ends its access to your repositories immediately.

Infrastructure and encryption

  • Striff runs on DigitalOcean in Toronto, Canada. Its database and cache run inside a private cluster and are not reachable from the internet.
  • All traffic to striff.io and api.striff.io is encrypted with TLS. Webhooks from GitHub are verified by their signature before Striff acts on them.
  • Stored data sits on DigitalOcean block storage, which is encrypted at rest.
  • Striff reaches GitHub with short-lived installation tokens, limited to the repositories you chose.
  • The dashboard signs you in with GitHub and follows your GitHub permissions: you see an organization's or a repository's results only if GitHub says you can.
  • Credentials are kept in the cluster's secret store, never in source code.
  • Error reports sent to our error-monitoring provider exclude personal data.

Retention and deletion

We keep analysis results while you use Striff, because your dashboard and its history are built from them. To have your data deleted, email hi@haditechnology.com. We delete it within 30 days of your written request, or of the end of your subscription. Billing records are kept as long as the law requires.

If something goes wrong

If we confirm a security breach affecting your data, we will tell you without undue delay, and within 72 hours, with what we know and what we are doing about it.

Reporting a vulnerability

Email hi@haditechnology.com with "Security" in the subject. We will acknowledge your report within three business days and keep you updated until it is fixed. We will not take legal action against anyone who reports a vulnerability in good faith and does not access, change, or keep other people's data. Our security.txt is at /.well-known/security.txt.

Compliance and documents

Striff does not have a SOC 2 report yet. In the meantime we offer:

HADI Technology is a Canadian company. The European Commission and the UK recognise Canada's private-sector privacy law as adequate, so personal data can be transferred from the EU or the UK to Striff without extra safeguards.