Trust

Security fact sheet.

The answers security reviews ask for, on one page. Short and literal; the details are on Security and in the Privacy Policy.

Last reviewed October 15, 2026.

Company

Legal entity: Karthik Mulugu, doing business as Versyka, a sole proprietorship based in Michigan, United States.
Security contact: karthik@versyka.com · +1 (616) 522-2677. Reports go directly to the founder.

How access is granted: GitHub: a GitHub App you install, choosing which repositories it can see; uninstall it at any time. GitLab: a project or group access token you create and can revoke at any time.
GitHub App permissions: Repository contents: read and write. Pull requests: read and write. Checks, commit statuses and issues: read (to show your CI result and receive @versyka commands on Versyka's pull requests). Metadata: read. Email addresses: read (dashboard sign-in only).
Credentials: GitHub installation tokens expire after about an hour, are requested per job and are never stored. The sandbox that runs your build only gets a read-only token for the one repository it works on. GitLab access tokens and Slack webhook URLs are stored so Versyka can act later; GitLab tokens are encrypted with AES-256-GCM.
What Versyka writes: A branch and a pull request, created through the GitHub or GitLab API, never from the sandbox. Nothing is pushed to your default branch, and nothing merges without your review.
Dashboard sign-in: GitHub sign-in only. Versyka has no passwords to store.

Source code: Cloned into a disposable sandbox for each job and destroyed when the job ends. The daily scan reads dependency manifests and searches for AI model IDs through the API, without keeping the files. Source code is not stored by Versyka.
What is stored: Package names and versions from your manifests, vulnerability and model findings with their file paths, migration metadata (status, checks, pull request links, logs), account details from GitHub, and billing status from Stripe.
AI processing: Code and changelog text needed for a migration are sent to Anthropic's Claude API, under Anthropic's commercial terms.
Payment data: Handled by Stripe. Versyka never sees full card numbers.
Encryption: TLS in transit. Data at rest is encrypted by our database provider (Supabase).
Deletion: Uninstalling the GitHub App stops all access. Email us to delete account data (Privacy Policy).

Code execution: Builds and tests run in isolated E2B sandboxes, never on Versyka's own servers.
Edit boundaries: Edits are limited to files that deterministic code search matched. Repository content and changelogs are treated as data, not instructions.
Subprocessors: GitHub, Anthropic, E2B, Trigger.dev, Supabase, Vercel, Stripe, Resend, PostHog, Sentry and Cloudflare (what each does).

SOC 2: Not yet. We plan to begin as Versyka moves from pilots to paid plans.
Penetration test: Not yet performed.
Billing: Card payments through Stripe, or pay by invoice on the Scale plan.
Questionnaires: Send yours to karthik@versyka.com and we'll answer it directly.