Security & Trust
What ShipGate touches, what it stores, and what it does not claim.
Two entry points, one infrastructure
Continuous CI is hosted. The GitHub App fetches that single commit into a throwaway directory on WholeStack infrastructure — one commit deep — runs the gates there, deletes the checkout, and posts the “WholeStack / Readiness Advisory” check. The free scan at /scan/repo is the same trade without a pull request: you submit a repository or folder. There is no agent on your runners.
What we do not claim
Security pages usually open with badges. Here is the opposite list first, because it is the part that changes how you should plan.
No SOC 2 report exists and no audit is complete. If your process requires one, tell us early — we will say so in writing rather than hand you a readiness slide.
No certification, and no date to promise you one by.
There is no signed public CLI or npm package to verify. The shipgate binary in this monorepo is private and unpublished. Merge CI is the hosted GitHub App, not a workflow you run on your own runners.
This page quotes no uptime percentage. Enterprise agreements carry negotiated response and availability terms; nothing is implied outside one.
Controls that exist today
Access
- Sign-in: email and password, or Google or GitHub where the workspace enables them. SAML SSO and SCIM directory sync are not built.
- Roles: role-based access control on workspace resources.
- Multi-factor: available on accounts.
Audit log
- Exports are an NDJSON bundle with a manifest, a hash chain, and an HMAC signature — so an export can be re-verified afterwards rather than merely trusted.
- Retention is configurable per workspace rather than fixed by us.
- A single synchronous export is capped; larger ranges must be exported in windows. That limit exists so an export cannot stall the service, and the API says so rather than truncating quietly.
Transport and storage
- In transit: HTTPS everywhere; HTTP is redirected.
- At rest: application data lives in a managed PostgreSQL database at our hosting provider, and OAuth tokens are encrypted before they are stored.
Service levels
No uptime figure is published here, because publishing one we have not measured and cannot be held to is worse than saying nothing. Two things are worth knowing regardless of contract:
- Continuous CI is hosted. If the check cannot post, the absence is visible on the pull request rather than a silent green. That is not an uptime promise — it is how the check is designed.
- Enterprise agreements carry written response targets, an escalation path, and a named support channel. Those numbers are negotiated per contract, never published as a marketing SLA.
Incident response
If a breach affects user data, we will notify affected users and the relevant supervisory authorities as required by applicable law, and the notice will state what was affected, what we did, and what you should do. We are not going to characterise our internal runbook maturity on a marketing page.
Vulnerability disclosure
We welcome responsible disclosure. Our full disclosure policy covers scope, timelines, and researcher protections. The quick version:
- Report to security@shipgate.dev.
- We aim to acknowledge reports within two business days.
- No legal action against researchers who follow responsible disclosure practices.
- Credit in advisories, if you want it.
Sub-processors
ShipGate is operated by the same company, on the same infrastructure, as the rest of the platform — so it shares one sub-processor list rather than keeping a second copy that can drift out of agreement with the first. See the current sub-processor list, which names each provider, what it handles, and where processing happens.
Data retention
- Account and workspace data are retained while the account is active.
- Audit-log retention is configurable per workspace.
- To request an export or deletion, contact privacy@shipgate.dev.
Contact
Security: security@shipgate.dev
Privacy: privacy@shipgate.dev
Everything else: team@shipgate.dev