Security

1. Our Approach

This page describes our current security practices. It is a statement of practice, not a certification — Graphsky does not currently hold SOC 2, ISO 27001, or similar attestations.

2. Encryption in Transit

All traffic to graphsky.app is encrypted with TLS, including API and real-time connections.

3. Authentication

You can sign in with an email and password or with GitHub OAuth. Passwords are stored only as salted hashes — never in plain text — and GitHub sign-in relies on GitHub's OAuth flow rather than a password we hold. Sessions use secure cookies and can be revoked server-side.

4. Repository Data

Repository content you import is processed only to build and maintain your canvases. GitHub access is scoped to the repositories you choose to connect.

5. AI Data Handling

Code excerpts are sent to our AI provider only to fulfill the AI requests you make (import analysis, advisor suggestions), not for unrelated purposes. Requests are routed through the Vercel AI Gateway to Anthropic, which provides the models that generate these results.

6. Infrastructure

The Service runs on managed cloud infrastructure. Convex hosts our database, backend functions, and authentication, and Cloudflare serves the application at the edge. These providers handle physical security, patching, and network isolation at the platform level.

7. Responsible Disclosure

If you believe you have found a security vulnerability in Graphsky, please report it to hello@graphsky.app. We appreciate good-faith reports and will respond as quickly as we can. Please do not access other users' data or degrade the Service while testing.

8. Contact

Security questions? Email hello@graphsky.app.