Security & Data Practices
Transparency about how WarpFix handles your code, data, and security.
AILLM Provider
WarpFix uses OpenAI GPT-4o as its primary LLM for patch generation, code review intelligence, and chat agent responses.
- •Zero data retention: We use the OpenAI API with data retention disabled. OpenAI does not store or train on any data sent through our API calls.
- •Minimal context: Only the specific error logs and directly relevant source files are sent — never your entire repository.
- •No fine-tuning: Your code is never used for model training or fine-tuning. Period.
↓Data Flow
Here is exactly what happens when WarpFix processes a CI failure:
CI Failure Detected
GitHub webhook notifies WarpFix of a failed workflow run.
Log Retrieval
WarpFix reads only the failed job logs via GitHub API (read-only).
Error Classification
Logs are parsed and classified locally — no external calls yet.
LLM Patch Generation
Relevant code context + error snippet sent to OpenAI GPT-4o for patch generation. No full repo sent.
Sandbox Validation
Candidate patch is tested in an isolated Docker container. No access to production.
PR Submission
If validation passes, a PR is opened via GitHub API. Humans review before merge.
🔒Encryption
In Transit
All data is encrypted in transit using TLS 1.3. All API endpoints enforce HTTPS. HSTS headers are set with a 1-year max-age.
At Rest
Database storage uses AES-256 encryption at rest. OAuth tokens and secrets are encrypted before storage using application-level encryption.
⏱Data Retention
| Data Type | Retention |
|---|---|
| CI logs (raw) | Processed in memory, discarded after repair (not stored) |
| Error fingerprints | Stored indefinitely (hashed patterns only, no source code) |
| Repair metadata | 90 days (repair type, status, timestamps) |
| Generated patches | Deleted after PR is opened (not persisted) |
| Account data | Until account deletion + 30 day grace period |
⚙GitHub App Permissions
WarpFix requests the minimum permissions necessary. Here is exactly what each permission is used for:
✓Compliance & Standards
SOC 2 Type I
In Progress — Q3 2026Audit initiated with Vanta. Expected completion Q3 2026.
GDPR
CompliantData processing agreement available. EU data handled per GDPR requirements.
Questions?
If you have security questions or need a Data Processing Agreement, contact us at security@warpfix.org. We respond to all security inquiries within 24 hours.