Security
Built to be trusted with your code.
Versyka changes code, so trust is the product. Here's what we can access, where your code runs, and what we keep.
Principles
Pull requests only
Versyka never pushes to your default branch. Every change is a PR that your team reviews and merges.Least-privilege access
The GitHub app requests only repository contents, pull requests, and metadata, and only on repositories you select. Dashboard sign-in adds read-only access to your email address, nothing else.Short-lived credentials
GitHub access uses installation tokens that expire after about an hour, and we never store them. The build sandbox gets a read-only token for one repository. GitLab tokens you connect are stored encrypted (AES-256-GCM).Isolated sandboxes
Your code is cloned into a disposable sandbox for each job and destroyed when the job ends. It never runs on our own servers.No code retention
We store migration metadata (file paths, line numbers, PR links, status, whether you merged or closed Versyka's PR), not your source code.Untrusted input handling
Repository content and changelogs are treated as data. Edits are limited to files our code search matched.
Service providers
Versyka relies on these providers to operate. Each processes data only to provide its service.
| Provider | Used for |
|---|---|
| GitHub | Repository access and pull requests, via a GitHub app you install |
| Anthropic (Claude API) | Generating migration rules and code edits |
| E2B | Isolated sandboxes where code is cloned, built, and tested |
| Trigger.dev | Running background migration jobs |
| Supabase | Database for accounts, repositories, and migration status |
| Vercel | Hosting this website and dashboard; web analytics |
| Stripe | Payments and subscriptions (we never see full card numbers) |
| Resend | Transactional email, such as welcome and sign-in emails |
| PostHog | Product analytics on our website |
| Sentry | Error monitoring |
| Cloudflare | DNS and email routing |
Compliance
Versyka is an early-stage company and does not yet hold a SOC 2 report. We plan to begin SOC 2 as we move from pilots to paid plans. If your security team has a questionnaire, send it over and we'll answer it directly.
Reporting a vulnerability
If you believe you've found a security issue, email karthik@versyka.com with the details. Please give us a reasonable chance to fix it before disclosing it publicly.