Privacy

Last updated October 26, 2026

ShipMesh is a merge gate: it reads a pull request, explains it, and asks its owner to sign off. This page says exactly what that involves for your code and your data.

What ShipMesh can access

ShipMesh works through a GitHub App that you install on the repositories you choose. With the permissions you grant, it can:

• Read pull requests: title, description, author, commits and the changed files with their diffs.
• Read CI results for the PR's commits (checks and workflow runs), which it reports as evidence.
• Read files it needs from your repository: .shipmesh/profile.yaml and the decision records in docs/adr/.
• Write only three things: its own check on the PR, its own comment on the PR, and the approved decision record, which it commits to the PR's branch after the owner signs off.
• Read PR comments, to act on /shipmesh commands.

Uninstalling the App, or removing a repository from it, stops all access immediately.

What we store, and what we don't

We don't store your source code or diffs. They're fetched when a gate runs, analyzed, and discarded. We store:

• Pull request details: repository, number, title, author, branch names and commit IDs.
• CI evidence: the names, results and links of your checks.
• ShipMesh's analysis: the walkthrough, findings, architecture map, draft decision record and the explain-back questions. These mention file paths and describe the change in prose.
• Sign-offs: who signed, when, which answers they picked, and the reason when someone signs off without explain-back.
• An audit log of gate decisions: who did what, and when.
• Your GitHub username when you sign in, to show you your runs. Sign-in uses a session cookie that lasts 12 hours. We don't use tracking or advertising cookies.
• Your email address, if you request an invite on this site.
• Billing details, if you buy credits: your email, your Stripe customer ID, your credit balance and which pull requests used a credit. Card details go straight to Stripe; we never see them.

How changes are analyzed

ShipMesh sends the pull request's diff, description and commit messages to Google's Gemini models on Vertex AI, running in our own Google Cloud project. Before sending, it redacts common secret formats such as keys and tokens. Under Google Cloud's terms, Google doesn't use this data to train its models. Model output is treated as data: ShipMesh only takes the specific actions listed above.

Where your data lives

Data is stored in Google Cloud Firestore in the United States (us-central1), encrypted at rest, and is readable only by the ShipMesh service. Each customer's data is kept under its own scope, and our tests check that one customer's data can never be read through another's.

The services we rely on:

• Google Cloud: hosting, database and Vertex AI.
• Cloudflare: this website, DNS and the network edge in front of the app.
• GitHub: where your code and ShipMesh's checks and comments live.
• Stripe: payments, if you buy credits.
• Google Fonts: serves this site's typeface, which means your browser requests it from Google.

How long we keep it

• Gate runs and their analysis, evidence and sign-offs are deleted automatically 90 days after they're created.
• Approved decision records are committed to your repository, so you hold the lasting copy.
• The audit log is kept while your installation is active, so sign-off decisions stay accountable.
• Invite requests are kept until the private beta ends.
• Billing records are kept while you have an account with us, and as long as the law requires for payments.

What we don't do

We don't sell your data, share it for advertising, or use your code to train models.