Trust Center
How CodeRifts handles your data, what permissions it requires, and where it runs. No marketing — just facts.
Data Handling
No spec storage
CodeRifts does not store your API specs. Specs are processed in memory and discarded after analysis.
Only diff results returned
Only diff results (risk scores, detected patterns, changelog) are returned to the caller. We persist derived verdicts and metadata — not your schema bodies or source code.
No PR content stored
GitHub PR comments are written by the GitHub App using the GitHub API. No PR content is stored.
GitHub App Permissions
CodeRifts requests the minimum permissions needed to function:
| Permission | Level | Why |
|---|---|---|
| Pull Requests | Read/Write | To read PR diffs and post comments |
| Contents | Read | Read allows repository file access; CodeRifts reads configured spec files and .coderifts.yml, and — when MigraGuard/ActionGuard are enabled — migration files, source references and workflow YAML, in memory only |
| Checks | Write | To post check run status (block/pass) |
| Metadata | Read | Required by GitHub for every App; no content access of its own |
Core Diff reads configured specification files only; opt-in MigraGuard and ActionGuard also read configured migration files, application source references and workflow YAML — processed in memory, never persisted. No access to issues, secrets, or organization data beyond what is listed above.
What this page does not cover yet
Everything above is about one of the three ways CodeRifts touches your work: the GitHub App. The other two are not described here, and if you are installing an agent adapter this is where you would look for them.
- The hosted MCP server.
app.coderifts.com/mcpreceives the change set you send it — the before and after of the artifacts, not your repository.initializeandtools/listtake no key;tools/calldoes. The MCP page lists the three tools and the published surface digest. - The host adapters (
agent-hooks). These run on your machine, not ours. APreToolUsematcher reads the file an agent is about to write before the write happens. The install page states, per host, what each adapter enforces and what it does not see — including that a file written by a shell command does not pass through a Write matcher. - The keyless endpoints.
/api/v1/action-verdictand keylesspreflightanswer without an account, and return a signed receipt anyone can verify offline. A caller with no key is still a caller: what is retained for those requests is not described on this page.
Listed as a gap rather than left silent. Measured 2026-09-14.
Infrastructure
Backend: Railway
EU region if available, otherwise US.
Website: Cloudflare Pages
Static site served from Cloudflare's edge network.
No third-party analytics on API traffic
Read that scope literally. This site — including the page you are on — loads Google Analytics and Cloudflare web analytics; the privacy notice names both. What carries no third-party analytics is the API: requests to app.coderifts.com, the MCP server and the keyless endpoints are not sent to an analytics vendor.
API requests are not tracked by any external analytics service.
API keys hashed at rest
API keys are stored as SHA-256 hashes. Plaintext keys are never stored.
Compliance
GDPR
CodeRifts runs on read-only GitHub access and analyzes in memory. We persist derived verdicts, risk scores, structural identifiers and repository/PR metadata — not your schema bodies or source code. Request logs retain only truncated SHA-256 IP hashes, kept 90 days.
SOC 2
In progress.
Security contact
Uptime
Auto-deploy on main branch
Backend hosted on Railway with automatic deployments from the main branch.
No formal SLA yet
Targeting 99.9% uptime.