Security
Your code is yours. Here's exactly how Eblan handles it — deliberately boring, by design.
Eblan reviews your code, which means it has to read your code. We've designed every part of that flow to collect as little as possible, keep it as briefly as possible, and expose it to as few systems as possible.
What we access
The Eblan GitHub App requests least-privilege, read-mostly access:
- Read — code and diffs in repositories you choose, PR metadata, and files needed for context around a change.
- Write — PR review comments and approvals. Nothing else. Eblan never pushes commits, never merges, and never touches issues or settings.
You choose the repositories Eblan can see, and you can revoke access at any time from your GitHub settings — access dies with the installation.
What we store
Almost nothing. Eblan keeps lightweight PR metadata — repository name, PR number and title, review status and timings — to run the service and show you history. Source code, diffs, and review content are processed in memory and not persisted after a review completes.
How your code is processed
To review a change, Eblan sends the diff and relevant context to the Claude API, operated by Anthropic, PBC. That processing is governed by Anthropic's commercial terms:
- Code sent to the Claude API is never used to train models.
- Anthropic retains API inputs only briefly for abuse monitoring, per its data policies.
Eblan does not send your code anywhere else. No third-party analytics on code content, no advertising, no "anonymized" data sales.
Infrastructure
- All traffic is encrypted in transit (TLS 1.2+).
- Stored metadata is encrypted at rest.
- Access to production systems is limited to the founding engineers, with hardware-key two-factor authentication.
- Secrets are managed in a dedicated secrets manager and rotated regularly.
Compliance
We're a young company, and we'd rather be honest than impressive: a SOC 2 Type II audit is in progress, and we'll publish the report's availability here when it completes. In the meantime, the practices above are the actual, current state of the service.
Reporting an issue
Found a vulnerability or something that looks off? Email security@eblan.site. We triage security mail first, and we'll keep you in the loop on the fix. Responsible disclosure is welcome and credited.