Sanctra
Security overview

Boring, on purpose.

Sanctra touches your repository. That deserves conservative defaults, transparent behavior, and mechanics you can audit. Here's how we approach it.

Principles

Four commitments that don't change.

Least-privilege access

Sanctra requests only the GitHub scopes required to analyze code and open PRs. Installation is per-repository and revocable at any time.

No direct commits

Every change ships as a pull request on a Sanctra branch. Sanctra cannot merge, force-push, or modify your default branch.

Secrets stay yours

Sanctra generates .env templates and secret checklists. It never retrieves, stores, or forwards secret values.

Auditable by design

Every analysis, generation, and PR is logged with a diagnostic ID. History is preserved even for dismissed recommendations.

Data handling

What Sanctra touches, keeps, and forgets.

Source access
Sparse GitHub checkout, in-memory analysis, discarded after job completion.
Persistence
Repository metadata, analysis reports, and generated files. Not raw source.
Retention
Analyses retained per plan. Deletable on request.
Encryption
TLS in transit. AES-256 at rest for stored analyses and metadata.
Isolation
Per-tenant workspaces. Analysis jobs run in isolated compute contexts.
Third parties
GitHub for source. AI providers only receive redacted repository summaries.

Have a security question?

We publish incident notes, respond to responsible disclosure, and sign customer questionnaires for beta partners.

security@sanctra.devRequest access →