Data Security & Privacy
Client trust is a top priority. Documentor Pro is built from the ground up to ensure client code and data remain secure, private, and strictly under client control.
Open Source Foundation
Documentor Pro is proudly built by the creator of the documentor-ai open-source package. Clients who prefer a self-managed environment can always use the open-source package themselves directly.
No Code Storage
We never clone, store, or retain your raw source code.
No Documentation Storage
Your generated markdown stays on your GitHub repository. We don't store it anywhere.
Secure API Key Storage
LLM API keys are encrypted at rest using AES symmetric encryption (Fernet) and never stored in plain text.
Vector Embeddings Storage
Vector embeddings are only saved for AI Plus users. Not for other users.
Frequently Asked Questions
Does Documentor
store client source code?
No, Documentor does not clone or store full source code repositories. Documentation generation happens directly in your CI/CD pipeline. Your GitHub Actions runner processes the code and securely pushes only the generated documentation and vector embeddings via OIDC. Your raw source code never touches our servers.
What data does
Documentor actually store?
Documentor only stores the generated vector embeddings (for AI chat) and repository metadata (like commit hashes to track changes). The actual markdown documentation is pushed directly to your GitHub repository and is not stored on our servers.
Will client code
be used to train AI models?
Absolutely not. Documentor uses a "Bring Your Own LLM" model. When clients use their own OpenAI or Anthropic API keys, the data is routed directly to those providers. Documentor enforces zero data retention policies for AI training. Proprietary code remains under strict client ownership.
How is data
isolated between clients?
Documentor Pro implements strict tenant isolation at the database level. Each client's documentation and vector embeddings are stored securely and query operations are strictly scoped to the authenticated repository and workspace context using PostgreSQL Row-Level Security principles. We only store vector embeddings for AI Plus users.
What GitHub
permissions are required?
Our GitHub App requires Read-Only access to verify repository permissions and workspace membership for users. It does not clone your repository to our servers. Ingestion is handled entirely via your own GitHub Actions runners using secure OIDC tokens.
Is my data
encrypted?
Yes. All data is encrypted both in transit (using TLS 1.3) and at rest (using AES-256 encryption). We adhere to industry best practices to ensure your metadata and vector embeddings remain completely secure.
Who can access my
data and embeddings?
Access is strictly limited to authorized members within your Workspace. Documentor Pro employees do not have access to your vector embeddings or repository data unless explicit consent is provided for support purposes.
How does the
Slack integration work securely?
The Documentor Slack bot operates strictly on a pull-model for RAG queries. When you ask a question, the bot maps your Slack channel to the authorized Workspace Integration. It then queries the vector database using only the context from your repository's embeddings. The Slack bot never has direct access to your source code.
Further questions regarding security?
Contact Security Workspace