Trust
A breach at PSCO would be a breach at every customer. So this page is part of the sale.
What PSCO holds, what it never holds, who can see what, and the status of PSCO's own audit. Written for your security reviewer; nothing here needs a call to explain.
SOC 2 Type I
In progressPSCO’s own SOC 2 Type I is in progress and targeted before public launch, with Type II within the first year. Evidence is collected from day one in the same GRC platform PSCO integrates with. The report will be available under NDA from this page once issued.
Certificate of insurance
Available on requestTechnology errors and omissions and cyber liability coverage sized to the customer base. The certificate of insurance will be published here once bound; until then request it from your account contact.
PSCO runs PSCO
The review app is installed on PSCO's own repository. Officers approve PSCO's pull requests, and the attestations will be published here as a live demonstration once the production signing key is in service.
GitHub App permissions
Two apps, so the first install asks for as little as possible.
A GitHub App's permissions are set at the app level, so the quote scan and the review loop are separate apps. The quote app reads metadata and pull requests and nothing else. The review app adds what the Officer needs to post a review and a check and to read the diff. Contents: write is never requested; the code enforces it by never holding a token that could push.
Webhook events the review app subscribes to
installation · installation_repositories · pull_request · pull_request_review · pull_request_review_comment · issue_comment · check_run · check_suite · status · push · repository · member · team · team_add
About Administration: read
It widens scope and some security teams ask about it. It is used only to call the branch protection and rulesets endpoints to verify your configuration. If you decline it, the dashboard falls back to a manual verification checklist and the attestation records branch protection as customer-attested.
Code at rest
No code at rest beyond the review session.
In software terms, this is what the claim means and how the code enforces it.
- 01Diffs and file contents are fetched from GitHub on demand, held in function memory, and never written to the database, Storage, logs or caches.
- 02Review packets store paths, line numbers, rule ids, clause references, hashes of flagged lines, structured AI findings and a prose summary. The triage prompt forbids quoting code, and a post-check rejects summaries that repeat the diff.
- 03Webhook payloads contain no diffs. Raw payloads are nulled after 30 days.
- 04The Officer console streams diffs through a proxy route with Cache-Control: no-store; the browser caches nothing beyond the tab.
- 05Error reporting scrubs request bodies; Sentry receives IDs and paths only.
- 06Code does transit to Anthropic for the packet summary. Per-org opt-out produces a packet without the AI summary.
Data handling
Tenancy, secrets, signatures, logs.
Controls designed in from the first migration, not added later. Each is tested in CI and will be evidenced in the SOC 2 report.
- TenancyRow Level Security on every table; the anon and authenticated roles never see another org’s rows. The service role is used only by workers and webhook handlers.
- SecretsStored third-party credentials use AES-256-GCM envelope encryption with versioned keys. GitHub installation tokens are minted per call and cached in memory under an hour.
- AttestationsEd25519-signed. Public keys are published at /.well-known/psco-attestation-keys.json; old signatures stay verifiable after rotation.
- Audit logEvery human mutation is logged: who, role, org, action, target, before and after. Customers see their own org’s entries under Settings.
- Staff accessOfficers, leads and admins sign in with mandatory TOTP. Officer GitHub accounts are PSCO-managed, 2FA enforced, used for nothing else. Any push by an Officer login pages the on-call lead and the customer.
- RetentionEvidence records are retained for 7 years. Data export and deletion are handled by admin runbooks with that carve-out stated plainly.
- Personal dataCustomer user emails and names, Officer HR data (restricted to admins), auditor emails. No end-user data from customer systems.
Subprocessors
Who else touches the data.
All in the United States. Code transits to Anthropic for the review packet summary and is not retained by PSCO; per-org opt-out produces a packet without the AI summary. A Data Processing Addendum is available.
| Subprocessor | Purpose | Location |
|---|---|---|
| Vercel | Application hosting | United States |
| Supabase | Database, auth, storage, queues | United States |
| Anthropic | Review packet summaries (code in transit, not retained by PSCO) | United States |
| GitHub | Source of pull requests; reviews and checks are posted there | United States |
| Stripe | Billing | United States |
| Resend | Transactional email | United States |
| Cal.com | Meeting scheduling | United States |
| PostHog | Product analytics | United States |
| Sentry | Error reporting (IDs and paths only) | United States |
| Background-check vendor | Officer identity, criminal, employment and education checks | United States |
US-only staffing
All review work is performed in the United States.
- Officers are US citizens or permanent residents working from the US. Citizenship and work location are verified and recorded.
- Identity, criminal (7-year, county and federal), employment and education checks through a licensed screening vendor, refreshed annually.
- Five or more years of software engineering with security work or a recognized credential (CSSLP, OSWE, GWEB, CISSP), PSCO certification, and a written confidentiality and conflict-of-interest agreement per customer.
- The Always-on tier is staffed from Alaska, Hawaii and West Coast Officers. No review work is routed offshore.
Documents
Terms of Service · Privacy Policy · Master Services Agreement · Data Processing Addendum · The guarantee. Security policies (information security, access control, change management, incident response, vendor management, acceptable use, business continuity) will be linked here once the Type I report exists. Security questionnaires and the certificate of insurance: book a call and ask.
Questions your security reviewer still has?
Book twenty minutes with the person who wrote this page. Bring the questionnaire.