Security & Trust

When you connect a GitHub repository through the difflore Cloud GitHub App, we receive and persist:

• PR review comments (pr_review_comments.body) including code snippets the reviewer quoted
• PR metadata: title, author, base/head SHA, file paths touched, merge state — but not full repository snapshots
• Extracted rule candidates: structured rules our pipeline derives from the comments (candidate_rules)
• Embedding vectors of those rules ( memory_nodes) — vectors only, not the original code
• Operational logs: webhook delivery records, request timestamps, rate limit counters

We do not clone, scan, or persist your repository contents outside the scope of received PR review comments and the file paths those comments reference.

• We never use your data to train AI models. Not our own, not our subprocessors'. This is contractual with Anthropic, OpenAI, and Voyage through their API terms, and reinforced in our own ToS.
• We never sell or share your data with third parties beyond the named subprocessors below.
• We never proxy LLM calls when you BYOK. When you provide an Anthropic or OpenAI API key, our worker authenticates directly to that provider with your key. The only thing we see is the prompt and response in transit; nothing is retained on our infrastructure beyond the structured extraction output.

We notify customers in advance of any subprocessor changes via the email on file. To subscribe to subprocessor change notices independently, email hello@difflore.dev.

For a PR ingestion event under platform-included quota (Pro/Team):

GitHub PR comment → difflore Cloud webhook (encrypted in transit, TLS 1.3) → pr_review_comments table (encrypted at rest, Neon-managed) → review-extractor worker reads comment → Anthropic API (HTTPS, no retention by Anthropic per zero-data-retention terms) → extraction response written to candidate_rules → embedding sent to Voyage (HTTPS, no retention) → vector written to memory_nodes

For a BYOK customer the LLM call uses the customer's key against their own provider account; the prompt + response still passes through our worker but is not persisted beyond the extraction output.

Retention applies to raw comment bodies. Extracted rules and rule candidates are kept indefinitely as they form your team's accumulated review memory — but you can delete them at any time (see below).

• Export: Email hello@difflore.dev and we will provide a copy of the PR comments, candidate rules, and embeddings tied to your account (supporting your GDPR Article 20 portability right). Self-serve in-app export is on the roadmap.
• Delete: Settings → Account → Delete all my PR data immediately removes rows from pr_reviews, pr_review_comments, candidate_rules, and memory_nodes for your account. Irreversible.
• Disable ingestion: uninstalling the difflore GitHub App from a repository stops new ingestion immediately. Historical data is retained per the schedule above unless explicitly deleted.
• BYOK opt-in: switching to BYOK stops platform-funded inference. The prompt still passes through our worker but the inference billing is now on your account, not ours.

• In transit: TLS 1.3 for all customer-facing endpoints; TLS (Neon-managed) for internal worker → DB connections.
• At rest: Neon transparent encryption (AES-256) for all persisted data. Application-level encryption for sensitive fields like userSync.settings.llmApiKey (BYOK keys) using AES-256-GCM with per-record IV.

A separate hardening track will extend application-level encryption to pr_review_comments.body for Team and Enterprise plans. Until that ships, raw comment bodies are protected by Neon's transparent at-rest encryption only.

In the event of a security incident affecting customer data, we commit to:

• Notify affected customers within 72 hours of confirmation.
• Publish a public post-mortem within 30 days of resolution.
• Coordinate disclosure with security researchers via hello@difflore.dev.

We do not advertise compliance certifications we do not yet hold. If a status above moves from planned to published, this page is updated and existing contracts are notified.

Security researchers, compliance contacts, and customers with questions should email hello@difflore.dev . We respond within 48 hours.

For data subject access requests under GDPR / CCPA / similar regimes, the self-serve Settings → Account → Delete all my PR data controls are usually the fastest path. Email us if you need a non-self-serve path.