Security & trust
We never store your source code. Architecturally.
Most analytics vendors promise data safety as a policy. We built it as a constraint: source code physically cannot end up in our database, because nothing in the pipeline writes it anywhere.
How a pull request is analyzed
- 1. Fetch, transiently. When your PR webhook fires, the diff is fetched into the memory of a short-lived, isolated worker. It is never written to disk or object storage.
- 2. Analyze in memory. Complexity, churn, Semgrep security rules, dependency risk, and secret patterns run inside that worker. For sampled reviews, the diff goes to a model running inside the same cloud project — no external AI APIs, no third-party keys.
- 3. Discard the code, keep the numbers. The worker exits; the diff is gone. What survives: metric values, finding counts and rule ids, file paths, scores, and written rationales.
Data inventory
What we store
- Commit metadata: author, timestamp, size, complexity delta
- PR lifecycle: cycle time, reviewers, check outcomes
- Security finding counts and Semgrep rule ids
- LLM scores and written rationales
- File paths and languages
- Your identity mapping (usernames ↔ work emails)
What we never store
- Source code, diffs, or file contents
- Repository clones (backfill clones live in ephemeral tmpfs, deleted on exit)
- Your GitLab tokens in our database — credentials live only in a dedicated secret store
- Lines of code or hour-of-day surveillance metrics — not stored because they're not measured
Platform security
- Tenant isolation: every row carries your tenant id; every query is tenant-scoped by construction, and analysis workloads run on per-tenant queues. Dedicated datasets are available on Business and Enterprise.
- Read-only, minimal access: the GitHub App requests read-only Contents, Metadata, and Pull requests (plus Checks write for the status line). GitLab connects with a group token you control and can revoke instantly.
- Your SSO, not our passwords: sign-in is exclusively via your Microsoft 365 or Google Workspace directory. We store no passwords.
- EU infrastructure: hosted on Google Cloud in the EU (europe-west1) with infrastructure defined entirely as reviewable code. Payment processing by Stripe; card data never touches our systems.
- Webhook integrity: GitHub events are HMAC-verified; GitLab events use per-tenant secret tokens; all comparisons constant-time.
Who builds this
WePerform is built and operated by Nextarp B.V., a Rotterdam-based company whose core business is identity verification and cybersecurity engineering. Treating your code the way we treat identity documents isn't a stretch for us — it's the default.
The full assessment methodology is public: read the rubric. Security questions or disclosure reports: info@nextarp.com.