What it touches
It reads support and errors, creates tickets in your tracker, opens PRs on the repos you pick, and posts to one Slack channel. Nothing else. Nothing runs without a click. Nothing merges without a human.
We never ask for personal access tokens, production database access, SSH or deploy keys, or write access where read is enough. Patcharc opens pull requests; you deploy.
A run, start to finish
- A person on your team presses Fix with AI. Nobody else can start a run, and a customer’s message never does.
- A new virtual machine starts for that run alone. It shares nothing with any other run or workspace.
- Your code arrives as a shallow clone, through a GitHub token that lasts about an hour and opens that one repo.
- The machine can reach GitHub, your model provider and your package registries. Nothing else resolves.
- The agent works inside a hard clock and a hard budget, and the policy checks its diff before anything is pushed.
- Patcharc opens a draft pull request and destroys the machine — on success, on failure and at a cap.
Keys
| Key | Whose | What it is for |
|---|---|---|
| Support, error and tracker tokens | Yours | Reading conversations and errors; creating and moving issues |
| Slack bot token | Yours | Posting to one channel |
| Your model key (BYOK) | Yours | The agent’s requests to your provider |
| Our model key (Managed AI) | Ours | Managed AI runs only; never inside the machine |
| GitHub installation token | Minted per run, for about an hour | Clone, push, open the pull request |
| GitHub App private key | Ours | Minting that token, and nothing else |
Every secret is encrypted with AES-256-GCM under a key of its workspace, and every workspace key under a master key in AWS KMS that never exists on a machine we run — a stolen database dump holds no usable credential. A secret is decrypted inside the job that needs it and dropped; once saved it is never shown again, only a masked suffix. Values from the vault are masked in every log and in our error reports, and a test holds that.
Keys meet the machine at its edge: the network proxy adds the GitHub token and the model key to requests for their own hosts, so the agent holds a placeholder that is worthless if stolen. If a coding agent refuses a placeholder, that one key goes in as an environment variable inside the machine and is wiped when the run ends. On your own key, model traffic goes to your provider directly, never through an account of ours.
Prompt injection
A customer’s words reach an agent that writes code, so they are treated as the most dangerous input in the system. They arrive in a delimited block labelled untrusted — data for the agent, never instructions to Patcharc.
The agent’s authority does not come from its prompt. Its branch, forbidden paths, diff size and network are fixed outside it and checked after it finishes, so a message that talks the agent into touching your billing code still fails before the push. And nothing merges automatically: a person on your team reads every pull request and merges it on GitHub, with their name on it.
Who can do what
Only a signed-in member of your team turns a report into a ticket or a run, and who may press Fix with AI is a grant per member. Every check runs on the server: calling the API directly meets the same checks as the button.
Every action is written to the audit log as a sentence — who connected what, who clicked, what ran, which pull request opened, who changed a setting — kept for the life of the workspace and exportable.
Threat model
| Threat | Where it enters | What stops it |
|---|---|---|
| One workspace reading another’s data | Any query | Every query is scoped to its workspace by construction, and a test proves the wrong workspace sees nothing |
| A stolen database dump | The database | Secrets are envelope-encrypted; the dump holds no usable token |
| A forged webhook | Public endpoints | Signatures checked in constant time with a replay window, failures alerted on |
| Prompt injection in a report | The agent’s prompt | Report text arrives as labelled, untrusted data; the agent’s limits are enforced outside the prompt |
| Escape from the machine | The run | A virtual machine per run, egress to an allowlist, destroyed after |
| A token in a log | Everywhere | Masked at the logger, held by a test |
| A customer triggering code | The pipeline | Only a team member’s click starts a run |
| A malicious upload | Attachments | Size and type limits; executables, archives, HTML and SVG refused |
| A webhook flood | Public endpoints | Rate limits per workspace and endpoint; a flood becomes a queue, never a loss |
Subprocessors
| Who | What for | What they see |
|---|---|---|
| Railway | Hosting the app, the database and the queue | Your workspace’s data, with secrets only in encrypted form |
| E2B | The virtual machine for each run | Your code, for the length of a run |
| Cloudflare | This website, and storage for attachments, run logs and backups | Requests to the site; stored files, with backups encrypted |
| AWS KMS | The master key | Requests to wrap and unwrap keys, never your data |
| Resend | Sign-in and notification email | Recipients’ addresses and the email’s text |
| Sentry | Errors in our own code | Our application’s errors, with secrets masked |
| Paddle | Billing, as merchant of record | Billing name, email, address and payment |
| OpenRouter | The pre-read that sorts incoming messages, and on Managed AI the call that picks the model | A report’s text and evidence, sent only to providers that keep nothing and train on nothing |
| Anthropic | Managed AI runs | The code and context of a Managed AI run, under Anthropic’s commercial terms |
On your own key, your model provider works for you, not for us. The hosting region is stated here before launch.
Retention
| What | How long |
|---|---|
| Webhooks as they arrive | 30 days |
| Run logs | 30 days |
| The audit log | The life of the workspace; cold storage after 24 months, still exportable |
| Secrets | Deleted when you disconnect |
| Backups | 30 daily and 12 monthly copies |
Backups and recovery
Two copies: the host’s own backups with point-in-time recovery, and a nightly dump encrypted before it leaves, kept in a separate, locked bucket away from the host, which a stolen token can neither read nor delete. Every week a job restores the latest dump and counts its rows; the full restore is rehearsed before launch and twice a year.
Recovery point: minutes. Recovery time: one hour.
Deletion
Delete a workspace and its reports, attachments, runs and their logs, connections and secrets are gone — a test walks every table to prove it. The audit log stays, anonymised. Cancelling never deletes anything; you decide when.
Report a vulnerability
Email [email protected]. We follow 90-day coordinated disclosure. There is no bounty.
What we do not have yet
No SOC 2 report. A data processing agreement is sent on request until the reviewed one is published here. Questions about any of this: [email protected].