Encrypted transport and managed storage
Arbor is served over HTTPS. Production data lives in managed providers with encrypted storage and operational access controls.
Back to Arbor
Data Handling
Real controls, plain language.
Arbor reads code to explain PR impact, so the trust page has to be concrete. This is what exists today, what comes from managed providers, and where we still need to ship more.
Implemented controls Provider-backed infrastructure Clearly marked limits
Production controls
What is real today
Concrete controls in the running product and infrastructure stack.
GitHub webhook verification
Webhook payloads are verified before they enter the analysis pipeline. Unverified deliveries are rejected.
Per-installation token boundaries
GitHub API access uses installation-scoped tokens. Arbor does not intentionally reuse tokens across tenants.
No repository code execution
The analyzer parses repository code structurally. It does not run customer tests, execute application code, or evaluate scripts.
Allowlisted settings writes
User-controlled repository settings are sanitized in the Next.js API proxy before being forwarded to the Rust API.
Parameterized database access
Rust API data access uses parameter binding through sqlx. Dynamic SQL string assembly is not used for application queries.
Data handling
What Arbor stores
The key operating principle: store product results, not long-lived source snapshots.
Account and GitHub metadata
Login, user id, avatar URL, installation identity, and repository metadata needed to operate the GitHub App.
Analysis results
Verdicts, paths, PR identifiers, timestamps, run metadata, and dashboard links.
Repository source snapshots
Repos are cloned for analysis work and should be treated as ephemeral worker data, not product data.
Payment card data
Card entry and payment processing are handled by Stripe. Arbor stores billing state, not raw card numbers.
Subprocessors
Third parties in the Arbor Cloud path
These vendors may process customer data when Arbor Cloud is used.
ProviderPurposeSafeguards
GitHubApp install, OAuth, repository metadata, webhooks
GitHub terms and security programVercelFrontend hosting and edge functions
Managed platform controlsRenderRust API, workers, and managed PostgreSQL
Managed platform controlsStripeCheckout, subscriptions, invoices, and payment method handling
PCI DSS Level 1SentryError and performance telemetry when configured
PII scrubbing configured in application codeHonest limits
What is not claimed yet
No badge theater. If something is not finished, it stays named here.
Formal certification
Not claimed yet. If we do not have an external report or signed agreement, we say that plainly.
Data deletion workflow
Handled case by case until the self-serve workflow ships.
Subprocessor packet
Architecture overview, subprocessors, and data flow notes are available on request.
Paid bounty
Responsible disclosure is active. A paid bounty program is not launched yet.
Vulnerability disclosure
Found a vulnerability? Tell us first.
Email security@getarbor.dev with reproduction steps. We acknowledge reports, triage them, and coordinate disclosure with researchers who act in good faith.