Security at Comreadiness

How we handle your code and data

• Read-only, no clone. The GitHub connector uses a read-scoped Personal Access Token and the Git Tree API. Your repository is never cloned, forked, or mirrored.
• Bounded excerpts, not source archives. An assessment retains the evidence bundle it collected: repository metadata, configuration and documentation excerpts, and up to 20 source files the scan flags as critical per repository, capped at 12 KB per source file and 128 KB of source content per repository (project documents up to 32 KB each). The bundle is kept so findings stay auditable against their evidence, and it is deleted with the assessment. We never publish or redistribute source.
• Credentials encrypted and destroyable. Connector credentials and bring-your-own AI keys are AES-256-GCM encrypted at rest, zeroed on revoke, and never returned by any API response.
• AI processing is explicit and recorded. When AI phases run, code excerpts are sent only to the model providers configured for your run. Every assessment produces a processing record of what categories of data went to which destination, built for GDPR Art. 30-style review and viewable in-product on the assessment's data-provenance page. Prompt content is never stored. We do not train models on your code or findings.
• Membership checked on every request. Access to a project or assessment is resolved against your organisation's membership records in the database on each request, not from a cached claim, and an account suspended for abuse is locked out everywhere on its next request.
• Redaction mode for sensitive engagements. Any project can turn on report redaction: exported reports mask repository names, URLs, and owner identities, so a report can leave your organisation without identifying the codebase.
• Bounded retention of access logs. Request activity (including IP addresses) is pruned on a rolling retention schedule, 90 days by default; IPs are treated as personal data.
• Hardened public surface. Per-request Content-Security-Policy with nonces, same-origin enforcement on all state-changing routes, and rate limiting on public endpoints. Sign-in is OAuth only (GitHub/Google); we never see or store passwords.
• Transactional email from Sydney. Outbound email is sent via AWS SES in ap-southeast-2. No marketing email, no third-party mailing lists.

Comreadiness is operated by Belton IT Nexus Limited (New Zealand). We describe our posture in terms of what is implemented and verifiable. We do not currently hold SOC 2 or ISO 27001 certification, and we don't claim otherwise.

Responsible disclosure

If you believe you have identified a security issue in Comreadiness, report it privately and do not disclose it publicly until we have had a reasonable opportunity to investigate and remediate.

Please include a clear description of the issue, affected endpoint or workflow, reproduction steps, impact assessment, and any proof of concept needed to verify the report safely.

Security reports should be sent to [email protected]. We will acknowledge receipt and aim to respond with next steps as quickly as practical.

Please avoid actions that could degrade service, expose customer data, or disrupt other users while testing.