Grassion
Security at Grassion

Built for
enterprise trust.

Grassion analyzes engineering workflow metadata. We never read or store your source code.

Our commitment

Grassion never reads your source code. We only read PR metadata visible in GitHub — titles, commit messages, and timestamps. No code is stored. Ever.

What Grassion reads

What Grassion never touches

Exact GitHub permissions we request

read:user

Your GitHub username and public profile. Same as any GitHub OAuth app.

repo

Read PR metadata, commit messages, and review outcomes. Cannot write, merge, or modify anything.

read:org

Verify organisation membership. Cannot modify org settings or member permissions.

These are read-only scopes enforced by GitHub, not just our policy. Grassion is technically incapable of modifying your repositories. The same scopes are used by Vercel, Netlify, Linear, and thousands of developer tools.

Where your data lives

Database
Supabase PostgreSQL
SOC2 Type II certified. Encrypted at rest with AES-256. Mumbai region.
Hosting
Fly.io
SOC2 compliant infrastructure. TLS encryption in transit. Zero-downtime deploys.
Authentication
GitHub OAuth only
No passwords stored anywhere. JWT tokens expire in 7 days. Sessions revocable from Settings.
Payments
Razorpay
PCI DSS compliant. We never see or store card details; payment data goes directly to Razorpay.

Your data, your control

Delete all your data at any time from Settings → Danger Zone. We permanently remove all records within 24 hours. No backups retained. You can also uninstall the GitHub App at any time to stop all data collection immediately.

Security questions?

Email us at info@grassion.com
We respond within 24 hours.