Privacy policy

Who we are

Gitfence is operated by HootCodes LTD, a company registered in Bulgaria, European Union. Registered office: Aleksandar Stamboliyski Blvd 55, fl. 4, 1000 Sofia, Bulgaria. Company (UIC) number 208188022. VAT number BG208188022. In this policy, "we" means HootCodes LTD, "you" means the organization or person using Gitfence, and "members" means the people and AI agents you give access to.

Questions about privacy, and requests about your data, go to [email protected]. Company and contact details are also on our legal page.

Data Protection Officer: HootCodes LTD does not currently appoint a formal Data Protection Officer, as it does not meet the mandatory DPO appointment thresholds under GDPR Article 37. For all data protection matters, contact [email protected].

Controller or processor

Under the EU General Data Protection Regulation (GDPR), our role depends on the data:

• We are the controller for the account and billing data of your organization's admins and account owners, and for data about visitors to this website.
• You are the controller, and we are your processor, for your repository content and for the data of the members you give access to: their identities, signature records, access history and audit logs. We process that data only on your instructions, as set out in our data processing agreement (DPA), which forms part of our terms.

If you're a member of someone else's Gitfence organization, that organization decides what is collected about your access and is the first place to send requests. If you write to us instead, we'll pass your request on and help them respond.

What we store, and why

Your code

When you connect a GitHub repository, Gitfence keeps:

• A private mirror of the repository on our servers. It is never served to anyone.
• Filtered views: copies of the history built for each set of permissions, with hidden paths removed. Each member clones only their own view. Hidden files are never sent to people who can't see them, not even inside git history.
• Caches and derived data, such as the generated TypeScript declarations used for Types only, the mapping between original and filtered commits, and snapshots of pull requests, reviews, checks and issues fetched from GitHub so we can show members a redacted copy.

Repository content can include personal data, such as commit authors' names and email addresses. When a member runs tests through Fenced CI, the code is copied into a temporary sandbox with no network access. The copy is deleted when the run ends.

We use your code only to provide Gitfence to you.

Account details

When someone signs in with GitHub, we store their numeric GitHub ID, login, display name, avatar URL and, if they allow it, their verified primary email address. GitHub's access token is used once, at sign-in, to read those details. We don't keep it.

Public website analytics

On our hosted public website only, we use Umami, a self-hosted, cookieless analytics service running on our own infrastructure at umami.neatratapps.com, to count page views without cookies or personal profiles. It never runs in the Gitfence app or the self-hosted product.

Credentials

Gitfence tokens (git passwords and AI agent tokens), session IDs and invitation links are stored only as SHA-256 hashes, so we can check them but can't read them back.

Signatures

When a member signs a document you require (an NDA, for example), we record the typed full name, the time, the IP address (your own address, as passed on by our trusted proxy; we don't accept forwarding headers from anyone else), the browser's user agent, the document version and the SHA-256 hash of the exact text or PDF they were shown. Your admins can see these records and export a certificate for each one.

Activity and audit logs

To keep access accountable, we log events such as clones, fetches and pushes (with the person, the agent and the IP address), rejected pushes, test runs, AI agent tool calls, access requests and grants, invitations, settings changes and billing events.

Your admins choose how long to keep these logs: from 7 days to 10 years, or indefinitely (the default). Some records are always kept while your account exists, because other features depend on them: signature evidence, the history of access rules, and the access ledger behind exposure reports.

Integration secrets

If you connect Slack, Linear, Jira or a webhook, we store the tokens, keys and signing secrets it needs encrypted at rest (AES-256-GCM). They're decrypted only to talk to that service. If you link your Slack account, we store your Slack user ID so approvals can be matched to you.

Billing

Payments are handled by Polar, which acts as merchant of record: it processes the payment, handles tax and issues invoices. We store your plan, the number of restricted people billed and Polar's event IDs. We never see or store card numbers.

Why we process it, and our lawful basis

AI and your code

• We never use your code, or anything derived from it, to train AI models.
• Gitfence doesn't send your code to third-party AI providers. The service itself calls no AI or large language model APIs.
• AI coding agents that you or your members connect (such as Claude Code, Codex or Cursor) receive whatever that person's view contains, like any git client. How those providers handle that code is governed by your agreement with them.

Sub-processors

We use a small number of providers to run Gitfence. Each is bound by a data processing agreement or equivalent terms. The full list, with locations, is on our subprocessors page.

Webhook endpoints you configure receive the events you subscribe to; they're your destinations, not our sub-processors. We will update this list before adding a new sub-processor that handles customer data. Ask us at [email protected] if you want to be notified.

We don't sell personal data, share it with advertisers, or use it for advertising. We may disclose data where the law requires it, or to establish or defend legal claims.

International transfers

Gitfence is hosted in the European Union: the server in Germany, database backups in Finland. Some sub-processors (such as GitHub, Cloudflare, Postmark, Polar, Slack and Atlassian) are based in, or route data through, countries outside the European Economic Area, including the United States. Where that happens we rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's Standard Contractual Clauses.

How long we keep it

• Account and admin data: while your account is open.
• Repository mirror, views and caches: until you disconnect the repository or your account ends.
• Audit logs: for the retention period your admins choose (indefinitely by default). Signature evidence, rule history and the access ledger are kept while your account exists.
• Fenced CI copies: deleted when each test run ends.
• Backups: database backups are made daily and kept for 14 days; signed documents are backed up daily and kept for 30 days.
• Billing records: kept by Polar, and by us where needed, for as long as tax and accounting law requires.
• After your account ends, we delete its data, except where the law requires us to keep it. Deletion timeline, including backups, to be confirmed.

Your rights

If you are in the EU, the EEA or the UK, you have the right to:

• access the personal data we hold about you;
• rectify anything inaccurate (account details come from GitHub; update them there and they refresh on your next sign-in);
• erase your data;
• restrict or object to processing based on legitimate interests;
• port your data in a machine-readable format;
• withdraw consent where processing is based on it.

Admins can export the full audit log (JSONL or CSV), exposure reports for any person or path (JSON, CSV or a printable page) and signature certificates at any time, and can remove members, revoke tokens and disconnect repositories and integrations themselves. For anything else, write to [email protected] and we'll respond within 30 days.

You also have the right to complain to a data protection authority. Our lead supervisory authority is the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria, www.cpdp.bg, [email protected]. You can also contact the authority where you live or work.

Cookies and local storage

• This website sets no cookies. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device. Cloudflare may process technical request data (such as IP addresses) to deliver the site and protect it from abuse.
• The Gitfence app sets only what it needs to work: gf_session, which keeps you signed in for up to 30 days of inactivity, and gf_oauth_state, a short-lived security token that protects the GitHub sign-in step and is cleared when it finishes. The app also keeps your preferences (such as theme) in your browser's storage.

Because these are strictly necessary, you aren't asked to consent to them.

Security

How we protect your code, what our tests cover and the limits we know about are on the security page. To report a vulnerability, email [email protected] (see also security.txt).

Children

Gitfence is a business tool and isn't directed at anyone under 16. We don't knowingly collect data from children. If you believe a child has given us data, contact us and we'll delete it.

Changes to this policy

When we change this policy, we'll update the date below. If a change materially affects how we handle your data, we'll tell account admins by email before it takes effect.

Contact

Privacy questions, requests and complaints: [email protected]. Legal matters and security reports: [email protected]. Anything else: [email protected].

Last updated: 2026-10-10 (draft).