Legal
Privacy
Last updated 10 November 2026
Who this covers
This notice covers Git Outpost: accounts, organizations, connected Git hosts, and the reports those scans produce. It applies to people who create an account and to people invited into an organization.
Account
We store your name, email address, a hash of your password, whether the email is verified, and whether an authenticator is enabled. If you sign in with GitHub, Google, or GitLab, we store the provider and the identifier that provider assigns to you. We do not store that provider’s password.
Sessions
A signed-in browser receives a session cookie. We keep when the session was created and last seen, and a short form of the browser, so you can review devices on the account page and revoke one. Signing out or revoking the session deletes it.
Organizations and repositories
For each organization we store the name, who created it, members, invitations, roles, the subscription, and invoices. For each connected repository we store the host, the account it came from, the name, the default branch, whether it is private, and which checks are enabled. We do not publish that list.
Reports
A finished scan stores its findings: vulnerability identifiers, file paths and line numbers, redacted secrets, dependency names and versions, the AI review, and the change summary. Secret values are stored redacted. Members who can read reports in that organization can open them.
AI security review
The AI check sends repository context to the model provider for that review, currently through OpenRouter to Gemini, so the model can write the notes. Turn it on only for a repository you are willing to send. The written review is stored with the report.
Payments
Card numbers are entered on Stripe, not on Git Outpost. We keep the plan, the billing period, the invoice amounts, and the card brand and last four digits that Stripe returns.
How long it stays
Account and organization data remains while the account or organization exists. Deleting an organization removes its repositories, reports, members, and billing record. A session is removed when it ends or is revoked. The cookie page lists the cookies themselves.
What we do not do
We do not sell personal information, and we do not use advertising cookies. We do not use your repositories to train a model of our own.