Trust Center
Last updated: March 28, 2026
We built Kleore with security-first principles. Your CI data is sensitive — here is exactly how we protect it at every step.
Source Code Access
Kleore never reads, stores, or processes your source code. We analyze CI workflow metadata only — run status, timing, and test results. Your codebase stays on GitHub.
Encryption
- In transit
- HTTPS/TLS 1.2+ enforced on all connections. HSTS enabled with one-year max-age.
- At rest
- Database hosted on Supabase with AES-256 encryption at rest.
- Secrets
- GitHub tokens encrypted with AES-256-GCM before database storage. Encryption key stored in environment variables, never in code.
Authentication
- GitHub OAuth 2.0
- Users authenticate via GitHub — Kleore never handles passwords.
- Session security
- Cryptographically random session tokens. HttpOnly, Secure, SameSite cookies. Sessions expire after 7 days with rolling renewal.
- CSRF protection
- OAuth state tokens validated with timing-safe comparison.
API Security
- Rate limiting
- Every API endpoint is rate-limited per IP to prevent abuse and brute-force attacks.
- Input validation
- All inputs validated with Zod schemas. No raw SQL — Prisma ORM with parameterized queries.
- Error handling
- Generic error messages returned to clients. No stack traces, file paths, or schema details exposed.
- Security headers
- CSP, X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy enforced on all responses.
Webhook Security
GitHub webhooks are verified using HMAC-SHA256 signatures with constant-time comparison. Stripe webhooks are validated using Stripe's SDK signature verification. Invalid signatures are rejected immediately.
Data Handling
- What we store
- CI workflow run metadata (status, duration, timing), JUnit XML test results (test names, pass/fail), flaky event records, and cost estimates.
- What we don't store
- Source code, pull request content, issue bodies, commit diffs, or any repository file contents.
- Retention
- Data is retained while your GitHub App installation is active. Disconnect a repo from Settings to permanently delete all its data.
AI Analysis
AI-powered root cause diagnosis and auto-fix are processed by a third-party LLM provider. Only test names, failure patterns, and test file contents (when auto-fix is triggered) are sent for analysis. Your data is not used to train any models — our AI provider enforces a zero-retention policy for business usage.
Access Control
- User isolation
- Users can only access repositories belonging to their GitHub App installations, verified against GitHub's API on every request.
- Admin access
- Admin dashboard is rate-limited with separate authentication. Session tokens expire after 24 hours.
- Internal endpoints
- Cron and internal APIs are protected with timing-safe secret comparison. Not accessible from the public internet without the secret.
Infrastructure
Kleore is hosted on Render (SOC 2 Type II compliant). Database on Supabase (SOC 2 Type II compliant). Payments processed by Stripe (PCI DSS Level 1 certified). No source maps are served in production. The x-powered-by header is disabled.
Incident Response
- Detection
- Automated monitoring and request logging for anomaly detection.
- Containment
- Target containment within 24 hours of detection.
- Notification
- Affected users notified within 72 hours per our privacy policy.
- Review
- Post-incident review with root cause analysis and prevention measures.
Vulnerability Reporting
If you discover a security vulnerability, please report it responsibly. Email security@kleore.com and we will respond within 48 hours.
Third-Party Providers
| Provider | Service | Compliance |
|---|---|---|
| GitHub | OAuth & repository access | SOC 2 Type II |
| Supabase | Database & storage | SOC 2 Type II |
| Stripe | Payments & billing | PCI DSS Level 1 |
| Render | Application hosting | SOC 2 Type II |
| AI Provider | Root cause diagnosis & auto-fix | Zero data retention |
| Resend | Transactional email | SOC 2 Type II |