Security is the
product.
A compliance tool has to hold itself to a higher bar. Here's what we actually do to protect your code and data — and what we don't claim yet.
Built to minimise what we keep.
Scanned in memory
Code sent by MCP, the GitHub App or a public URL is analysed in memory and not stored. We keep findings and short excerpts only.
Encrypted excerpts
Code excerpts are encrypted with AES-256-GCM using a per-workspace key before they reach the database, on top of TLS and encryption at rest.
Hashed API keys
Keys belong to a workspace, can expire and be revoked, are shown once, and are stored only as keyed HMAC-SHA-256 hashes.
Workspace isolation
Row-level security limits every query to your workspaces. Scan results can only be written by our servers, so evidence can't be forged.
Secrets stay secret
Before any code is sent for an AI fix — only when you ask — secret values are redacted. We never log code, keys or model output.
Audit trail
Security-relevant workspace actions are recorded by the database itself in an audit log your admins can review.
What we don't claim (yet).
- RuleFix is not yet SOC 2 or ISO 27001 certified, and has not yet had an independent penetration test.
- There is no end-to-end encryption: our servers decrypt and process your data to provide the service.
- Application-layer encryption covers code excerpts, not every field; other data relies on TLS and our provider's encryption at rest.
- Using RuleFix does not make you compliant with any law or standard — see our Terms.
We'll update this page as that changes. For details of the data we hold and where, see the Privacy Policy and Sub-processors.
Found something? Tell us.
Email security@rulefix.in with a description, the affected URL or component, steps to reproduce and the potential impact. Please don't include real personal data you may have seen; describe it instead.
Our commitment
- We acknowledge your report within 3 working days and keep you updated until it's resolved.
- We won't take legal action against good-faith research that follows these rules, and we'll credit you if you'd like.
- We don't run a paid bug bounty at the moment.
Please
- Test only against your own account and workspace; never access, change or delete other people's data — stop and report if you do.
- Don't run denial-of-service, spam, social engineering or physical attacks, or test third-party services we use.
- Respect rate limits and keep automated testing gentle.
- Give us reasonable time to fix the issue before any public disclosure — we suggest 90 days, and we'll agree a date with you.
Misuse of RuleFix to scan systems without permission is covered by our Acceptable Use Policy; report it to the same address.