Data Access and Retention for Codelantis

We understand that evaluating any tool with access to company repositories requires transparency and trust regarding data access and retention.

Below, you will find a detailed explanation of the data we access, retain, and how we prioritize the security and privacy of your data. This document aims to provide clarity for any internal review by your company before granting repository access.

1. Data Access

Codelantis needs to connect to GitHub and/or GitLab to enable code reviews on these platforms. The following sections describe the nature and the type of data access when using the application.

a. Access Tokens for Single-Sign-On

  • Type: Short-lived (< 2 hours).

  • Purpose: Used to access repository data on behalf of the user during active sessions. The token is provided after the Single-Sign-On (SSO) authentication with the respective platform (e.g. GitHub). The authentication is handled by the official GitHub app (GitLab app) on the respective platform. The tokens provide temporary write access to the repository, which is necessary for posting comments in the user's name.

  • Storage: SSO access tokens are stored in our database, but automatically expire after the short (< 2h) lifespan set by the code platform (e.g. GitHub). When a user token expires, Codelantis can no longer access private repositories until the user re-authenticates with the target platform via SSO.

b. Repository Information

  • Accessed Data: We fetch repository data to enable code review functionalities. This includes:
    • Pull/Merge request details (e.g., metadata, changes, comments).
    • File paths within the repository to support specific features (e.g., marking files as reviewed).
  • Source Code: Source code is only accessed as requested by the user (i.e., when viewing a specific pull/merge request). No additional source code is being fetched. Furthermore, the repository is not being cloned/mirrored (Git) on our server.
  • Data Not Accessed: Source code (i.e. file content) is not stored in our database.

c. User Data

  • Access Data: Basic user information (such as username and email) is accessed during authentication to enable review discussions in the user's name. We only store the minimal user data necessary to achieve this task.

2. Data Retention

Certain data need to be persisted in our database for Codelantis to work as expected. We ensure that this is only done for this purpose, and that we limit the amount of stored data as far as possible.

a. Retained Data

  • File Paths: We retain file paths to facilitate review tracking and related features. File paths of inactive reviews (i.e. pull/merge requests that haven't been viewed in Codelantis for 90+ days) will be removed from our database automatically.
  • Review Metadata: Information such as pull request meta data, draft comments, review states, and user interactions are retained as needed to support app functionality.
  • No persistence of source code: We do not store source code of accessed repositories.

b. Temporary Session Data

  • Session Tokens: Used solely during user sessions and discarded after expiration or logout.
  • Request Data: User-triggered requests (e.g., fetching repository information) are processed in real-time and not retained beyond their immediate use.

3. Security Practices

  • Connection Security: All connections between Codelantis, GitHub/GitLab, and users are secured using SSL (HTTPS) to ensure encrypted data transfer.
  • Data Isolation: Your data is never shared with third parties unless explicitly requested through AI-powered features (see Section 4).
  • Patches of Third-Party Dependencies: Dependencies to third party libraries in our code base are continuously and, if possible, automatically being kept up-to-date, so that potential security patches can be incorporated and deployed in a timely manner.
  • Logging: App-internal logging (e.g. for debugging purposes) masks sensitive data (e.g., access tokens) to avoid storing these data in our database.

4. Third-Party Data Handling

  • AI-Based Features: If a user opts to use AI-driven functions (e.g., summarizing pull requests), data required for those specific features is sent to OpenAI or similar providers via their secure APIs.
  • User Control: This data transfer only occurs per individual user request initiated in the app's UI. No automatic data sharing occurs.

5. No Third-Party Data Sharing

  • Codelantis does not share any user or repository data with external entities other than the aforementioned AI features (only upon user request).
  • No advertising partners or analytics providers receive data from us.
  • We do not use tracking cookies or any form third-party cookies

6. Data Deletion Policy

Users have the right to request the deletion of their data at any time. Upon receiving such a request, we will promptly follow through to remove the user’s information from our systems, including any stored metadata (e.g., userId, image URL, name, and login-related data). Requests for data deletion can be initiated by contacting [email protected]

If your company requires additional assurance or documentation, please contact us via [email protected]

Questions or problems?
Contact Support codelantis.com