Security Policy

At SuperPlane, security is foundational to our product. Because our platform interacts with your source code, infrastructure and third-party tools, we employ strict security controls and transparent data practices to protect your assets.

1. Data Accessed and Stored

SuperPlane accesses only the data necessary to execute your workflows.

• Source Code: We clone your repositories into ephemeral, isolated environments during workflow execution. We do not permanently store your source code on our servers.
• Workflow Context: We store metadata about workflow runs, including logs, issue descriptions and pull request summaries, to provide visibility and debugging capabilities.
• Credentials: Any secrets or tokens you provide are encrypted at rest using industry-standard encryption (AES-256) and are only decrypted in memory when required for a workflow step.

2. Where Code Executes

Components run in different environments depending on whether they allow arbitrary code execution.

• Runner Components: Components that execute arbitrary code run in dedicated, isolated, ephemeral virtual machines or containers. These environments are destroyed after the runner execution completes.
• Other Components: Components that do not allow arbitrary code execution run on shared worker infrastructure.
• Hosting Locations: Our cloud infrastructure is hosted on major cloud providers (e.g., AWS/GCP) in the United States.

3. Data Sent to Model Providers

SuperPlane uses Large Language Models (LLMs) to automate tasks.

• Managed Models: If you use our managed models, relevant context (such as specific files, diffs or issue text) is sent to our third-party model providers via secure APIs. We use OpenRouter as our routing layer.
• Zero Data Retention (ZDR): We enforce Zero Data Retention policies through OpenRouter. This ensures that your data is not used to train foundational models and is not retained by downstream providers. OpenRouter itself also does not log or store your prompts or completions.

4. Required Permissions and Revocation

We request the minimum permissions necessary to operate your workflows.

• GitHub/GitLab Apps: We use granular, repository-scoped permissions. You can select exactly which repositories SuperPlane can access.
• Revocation: You can revoke SuperPlane's access at any time directly from your version control provider or third-party tool settings. Revoking access immediately stops our ability to interact with those systems.

5. Access and Approval Controls

SuperPlane is designed to keep humans in the loop for critical actions.

• Human Approvals: Workflows can be configured to require explicit human approval before taking sensitive actions, such as merging a pull request or deploying code.
• Role-Based Access Control (RBAC): Access to your SuperPlane organization, billing and workflow settings is restricted to authorized team members.

6. Application Logs

We maintain internal application logs covering workflow executions, API calls and system events. These logs are accessible to the SuperPlane team for operational monitoring and debugging.

7. Retention and Deletion

Workflow logs and metadata are retained for a limited period to allow for debugging and audit purposes, after which they are automatically deleted. If you delete your account, all associated data, encrypted secrets and workflow history are permanently destroyed from our active systems.

8. Cloud vs. Self-Hosted Differences

SuperPlane offers both a Cloud service and a Self-Hosted option.

• Cloud: We manage the infrastructure, isolation and security of the execution environments.
• Self-Hosted: You deploy SuperPlane on your own infrastructure. In this model, your source code and credentials never leave your network. You are responsible for securing the host environment, managing network access and configuring your own model provider API keys.

9. Compliance and Certifications

We are actively working towards SOC 2 compliance to formally validate our security practices. We understand that compliance is critical for our customers and we are building our infrastructure and internal processes to meet these rigorous standards. If you require more information about our compliance roadmap for your procurement process, please contact us.

10. Reporting a Security Vulnerability

If you believe you have found a security vulnerability in SuperPlane, please do not disclose it publicly. Contact our security team immediately at [email protected]. We take all reports seriously and will respond promptly to investigate and remediate the issue.