Security
How The Pass handles your code
Plain facts about your Pass server: where it runs, what is on it, what leaves it, and what we can and can't do.
Where your server runs
- One private server per team. No other customer's code or data is on it.
- Your server runs in the US at launch. US servers run on DigitalOcean, in data centers in the United States. Existing EU customers' servers continue to run on Hetzner, in data centers in Germany or Finland.
- We build it and run it. Path Toward sets the server up, keeps it updated and fixes it. Our operations team holds a login key for your server so we can do that, and so we can help when you ask.
- Your team signs in with GitHub. By default your server's dashboard admits only people your workspace has invited. You can also limit it to your own network addresses.
What is stored on your server
- Working copies of the repositories you connect, so it can review and fix them.
- Reviews and their results, and your CI status shown alongside them.
- Your team's decisions: findings you marked "not a problem" and lessons later reviews recall.
- Your AI provider keys, encrypted at rest (AES-256-GCM).
- Your GitHub App's credentials. They stay on your server.
- Your settings, and a log of changes made in your dashboard.
What leaves your server
To GitHubReview comments, checks and issues. With auto-fix on, fix commits in the pull request. Your server asks GitHub for new work; GitHub never has to reach your server.
To the AI providers you connectThe changed code and the context around it, sent under your own keys. Your contract with that provider applies, and you pay them directly.
To us, Path TowardA small health summary: which health checks are green, with reasons from a fixed list. No code, repo names, review text or file paths.
- The health summary is sent every few minutes and is on by default, so we hear about a broken key or a full disk before you have to tell us. You can turn it off in your server's settings. We keep at most the last 500 summaries per server, none older than 30 days; when you turn it off, what we hold is erased within 48 hours.
- Your server also checks in with our control plane for setup and account tasks.
GitHub access
During setup you connect GitHub and install The Pass's GitHub App on the repositories you choose. These are all the permissions it asks for:
| Permission | Level | Why |
|---|---|---|
Pull requests | Read and write | Read pull requests and post the review on them. |
Contents | Read; read and write for auto-fix | Read the code to review it. A review-only setup asks for read access only. A setup with auto-fix asks for write access, so it can push fix commits into the pull request. |
Checks | Read and write | Show the review as a check on the pull request. |
Issues | Read and write | Open an issue when something needs your attention. |
Metadata | Read | Required by GitHub for every app. |
- No webhooks. The app doesn't receive events from GitHub; your server asks for them.
- It never merges. A person merges, and your branch protection rules still apply.
- Auto-fix stays inside the pull request. Fix commits only touch the PR's own files. The app has no permission to change your workflow files, and auto-fix never edits them. You can turn auto-fix off for any repo or pull request.
When you cancel
- 30 days to change your mind. Your server stays up, read-only, for 30 days. Subscribe again in that time and it carries on as before.
- Then we delete it. We remove your server's web address, remove the GitHub App installation, and delete the server and everything stored on it.
- We email you when it's gone.
Companies involved
- Hetzner: hosts EU servers.
- DigitalOcean: hosts US servers.
- Stripe: payments. Stripe never sees your code.
- Postmark, with Resend as a backup: account emails, such as your setup link and receipts.
- Cloudflare: DNS for your server's web address on thepass.dev.
- Your AI providers: you choose them and contract with them directly. We are not in the middle.
Compliance
No SOC 2 report yet. We'd rather say so than leave you guessing. If you have a security questionnaire, send it to us and we'll answer it.
This website sets no cookies and loads no trackers, ads or third-party scripts or fonts.
Report a problem
Found a security issue, or have a question this page doesn't answer? Email support@thepass.dev.