Skip to content

Security

Truly Shipped asks for read-only access, never fetches your code or AI prompts, and encrypts everything it stores and sends.

What we can and can't see

  • GitHub: a GitHub App with read-only permissions (metadata, contents, pull requests, deployments, Actions, and Copilot metrics if you turn it on). Contents access is needed to list commits and to read line history (which commit last changed each line, used to measure rework); we never fetch files, the lines themselves or full diffs. Review comments arrive with the few lines of code they point at, which we store as GitHub sends them.
  • Jira: an API token you create, used read-only, plus signed webhooks.
  • Claude Code and Copilot: daily usage counts only. Our collector keeps one row per person per day; prompts and code never reach it.

How it's protected

  • In transit: HTTPS everywhere, with TLS on the app and on the usage collector.
  • At rest: the database and the collector's disk are encrypted. Connector credentials are encrypted again inside the application, and platform secrets live in AWS Systems Manager, never in code.
  • Network: the database has no public address. The collector has no SSH port; administrative access goes through AWS Session Manager and is logged.
  • Sign-in: no passwords. Sign-in links are single-use and expire in 15 minutes; the backup 6-digit code is stored only as a keyed hash and stops working after 5 wrong tries.
  • Isolation: every query is scoped to your workspace, and each workspace has its own collector token and Jira webhook secret. Every webhook is verified by signature before it's stored.
  • Access: only Truly Shipped's operator can reach production systems, and only for support or incident response.
  • Engineering: every change is reviewed and must pass automated tests, a static security scan and dependency vulnerability checks before it deploys.

Backups and deletion

Database backups are taken daily and kept for 7 days. Application logs are kept for 30 days. When a workspace is closed, its data is deleted within 30 days and ages out of backups within a further 7.

Certifications

Truly Shipped is not SOC 2 audited yet. If your review needs more than this page, write to us and we'll answer your questionnaire.

Reporting an issue

Email chris@trulyshipped.com. We'll acknowledge within 2 business days, and we won't take action against good-faith research that avoids other customers' data.

Last updated October 14, 2026. Questions? Write to chris@trulyshipped.com.