Security & Privacy

Your data is yours.
We take that seriously.

Exodocs connects to your code repositories, documentation hub, and notification channels. Here is exactly what we access, how we protect it, and what we never do.

Last updated June 2026 · reflects current production implementation

On this page What we access Encryption Data handling Access control Infrastructure Sub-processors Disclosure

Encrypted at rest

Your integration credentials are encrypted in our database using AES-256 column-level encryption. A database dump reveals only ciphertext.

Read-first, write only on your action

Exodocs never touches your repositories. It only writes to your documentation hub when you explicitly act: publishing an AI-drafted page or posting a drift annotation. Nothing is written silently.

No code stored

We never keep your source code. We store file paths and commit metadata only. Diffs and sampled files used for AI analysis are held in a short-lived working record that is deleted on completion, and never indexed or retained.

01

What Exodocs accesses

Exodocs connects to three categories of external service on your behalf: your code repository, your documentation hub, and your notification channel. Here is the precise scope of what we access in each, nothing more.

Code repository: webhook events + read-only API
We receive push events via webhook (file paths changed, commit SHA, author, message). We read commit metadata and the repository file tree via the provider's API. For AI features we fetch commit diffs and, when you generate documentation, a small sample of source files, used only for an in-progress analysis and deleted on completion. We never write to your repositories, and we never retain your source code.
Documentation hub: Notion or Confluence, scoped access
We use an integration token that you create and scope yourself within Notion or Confluence Cloud. We read the title, last-edited timestamp, and block content of pages you explicitly share with the integration. We only see pages you choose to connect. We never access your workspace broadly. We write only when you act: posting a drift annotation comment, or publishing a documentation page you generated and reviewed in Exodocs.
Notification channel: outbound alerts only
We use an incoming webhook URL to post alert messages to a channel you specify. This is a strictly one-way channel: we can only post messages. We cannot read your channel messages, access your workspace, or post to any channel other than the one the webhook is configured for.
02

Encryption

We apply encryption at multiple layers. All network traffic uses TLS. All integration credentials use column-level database encryption, which provides stronger guarantees than disk-level encryption alone.

Credentials encrypted at rest: AES-256-GCM
Your integration credentials (Notion and Confluence tokens, repository access tokens, and notification webhook URLs) are encrypted using AES-256-GCM before being written to our database. Even Exodocs engineers with direct database access cannot read your credentials in plaintext. Encryption keys are stored separately from the database.
Per-organisation credential isolation
Every organisation's tokens are stored and used only for that organisation. There is no shared or fallback credential. Exodocs will never use one customer's token to read or write another's data, even by misconfiguration. Tokens are decrypted only in-memory, server-side, at the moment an API call is made on your behalf.
TLS 1.2+ in transit, everywhere
All traffic between your browser and Exodocs, and between Exodocs and your connected services, is encrypted with TLS 1.2 or higher. HTTPS is enforced, so plain HTTP is rejected. SSL certificates are provisioned automatically and renewed before expiry.
Incoming webhooks: HMAC-SHA256 + source-IP verified
Every incoming webhook payload is verified using HMAC-SHA256 before it is processed. Payloads with an invalid or missing signature are rejected immediately with a 401 Unauthorized response. As a second layer, deliveries are checked against GitHub's published webhook source-IP ranges. This prevents spoofed webhook events from affecting your freshness scores.
03

What data we store, and what we don't

We store the minimum data needed to compute documentation freshness. We have made deliberate technical decisions to avoid storing sensitive information.

Data Stored? Details
Documentation page title ✅ Yes Cached title used for alert messages and the dashboard. Refreshed on sync.
Documentation page last-edited timestamp ✅ Yes Used to detect when a human has updated the document and reset the freshness score.
Documentation page content (text) ⏱ Cached 24h Plain text extracted from page blocks is cached for AI analysis. It is never written to our persistent database and expires after 24 hours.
Commit SHA, message, author ✅ Yes Stored to power the staleness event log and alert messages.
GitHub changed file paths ✅ Yes Stored as a JSON array. Used to match commits against your page-code mappings.
Repository file tree ⏱ Cached 24h Repository file tree cached for AI mapping suggestions. Never stored in persistent database.
Git diff / source code ⏱ Never retained Diffs and sampled source files are used only for an in-progress AI analysis, held in a short-lived working record that is deleted on completion (and within one hour at most). They are never indexed, searchable, or kept as a persistent store.
File contents ⏱ Never retained We persist file paths only. Sampled source files are used solely for an in-progress AI analysis, held in a short-lived working record that is deleted on completion (and within one hour at most), and never indexed, searchable, or kept as a persistent store.
Your integration credentials ✅ Encrypted Stored in AES-256 encrypted columns. Never logged, never sent to third parties, never visible in plaintext to any Exodocs team member.
Notification channel messages ❌ Never We post alerts to your notification channel via an outbound webhook. We have no ability to read your channel messages.
Data deletion: When you remove a documentation page or repository, we deactivate it and stop tracking it immediately; when you disconnect an integration, its stored credentials are removed from our database right away. When a subscription lapses or you close your account, your organisation enters a 90-day suspension grace period, after which all of its data, including deactivated pages and repositories, is permanently purged.
04

Access control & permissions

Exodocs uses role-based access control within every organisation. Your data is isolated at the database level: no organisation can access another's data by design, not just by policy.

Owner

Organisation owner

Full control. Manages integrations, billing settings, invites members, can delete the organisation.

Admin

Organisation admin

Manages pages, repos, and mappings. Can update integration settings. Cannot manage billing or delete the org.

Member

Member

Read access to the dashboard and staleness events. Cannot change settings or manage mappings.

Row-level tenant isolation
Every database query is scoped through the organisation. It is not possible for one organisation's users to access another organisation's pages, repos, or events, even if they share the same Exodocs account. Isolation is enforced in application code on every request, not just by convention.
Invite-only team access
New members join an organisation only by invitation from an owner or admin. Invitations expire after 7 days. There is no self-service way to join an existing organisation. Access must be explicitly granted.
Exodocs admin access: logged and limited
Exodocs internal team members with admin access can view organisation metadata (name, member count, plan) for support purposes. They cannot view your integration tokens in plaintext. Tokens are encrypted and only decrypted server-side when making API calls on your behalf. Admin access events are logged.
Account lockout protection
Accounts are locked after 10 consecutive failed sign-in attempts and unlock automatically after one hour, or immediately via an emailed unlock link. Brute-force attempts are blocked at the application level before reaching any data.
Two-factor authentication
Any user can enable TOTP-based two-factor authentication with an authenticator app. Enrolment generates ten single-use backup codes for recovery. 2FA is verified on every sign-in once enabled.
Password policy & hashing
Passwords must be at least 12 characters and meet complexity requirements. They are never stored in plaintext, only a salted bcrypt hash is kept. Exodocs cannot recover or view your password.
Organisation audit log
Every meaningful action (connecting a repo, inviting or removing a member, changing a role, adding a page or mapping, accepting an AI suggestion) is recorded in a per-organisation audit log that owners and admins can review at any time.
05

Infrastructure & availability

Exodocs is hosted on managed infrastructure with automated backups, monitoring, and zero-downtime deployments. We do not manage physical servers.

Application hosting: managed cloud platform
Exodocs runs on managed cloud infrastructure in the United States. The platform handles OS patching, hardware maintenance, and TLS certificate renewal automatically. We do not manage physical servers.
Database: managed with automated backups
Persistent data is stored in a managed relational database with daily automated backups. Backups are retained for 7 days. Point-in-time recovery is available on paid tiers.
Cache layer: ephemeral, never persistent
An in-memory cache layer is used exclusively for short-lived data: documentation page content (24h TTL), repository file trees (24h TTL), and background job queues. No persistent customer data is stored in the cache. Cache data is lost on restart without any impact on application correctness.
Zero-downtime deployments
Application updates are deployed with zero-downtime rolling restarts. Database migrations that require locking are applied during low-traffic windows. We aim for 99.9% monthly availability for paying customers.
06

Sub-processors

These are the third-party services that may process your data as part of the Exodocs service. We select sub-processors carefully and require that they maintain appropriate security standards.

Service Purpose Data processed Location
Railway / Render Application hosting & database All application data including encrypted credentials USA
Upstash Redis Ephemeral caching Documentation page content (24h TTL), repository file trees (24h TTL) USA
Anthropic AI drift analysis & mapping suggestions Commit messages, file paths, documentation page text (where AI features are enabled) USA
GitHub Code repository webhooks & API Commit events, file trees, diffs (read-only, where connected) USA
Notion Documentation hub reads & writes Page titles, timestamps, block content of connected pages; annotations/pages you publish (where connected) USA
Atlassian Confluence Documentation hub reads & writes Page titles, timestamps, body content of connected pages; annotations/pages you publish (where connected) USA / EU
Slack Outbound alert delivery Alert message content posted to your designated channel (where connected) USA
Stripe Subscription billing & payments Billing email, plan, and subscription status. Card details go directly to Stripe. Exodocs never sees or stores them. USA
Note on AI processing: When AI features generate drift summaries, mapping suggestions, or documentation drafts, commit messages, file paths, documentation page text and (for doc generation) sampled source files are sent to our AI provider (Anthropic) for processing. Untrusted content is sanitised against prompt-injection patterns before it reaches the model. You can disable all AI features in your organisation settings at any time.
07

Responsible disclosure

If you discover a security vulnerability in Exodocs, please email us privately at security@exodocs.dev before disclosing it publicly. We appreciate responsible disclosures and will work with you to address the issue.

Found something?

Email us with a description of the issue, steps to reproduce, and any relevant evidence.

security@exodocs.dev

We do not currently operate a paid bug bounty programme.

Please do not test against other customers' accounts or data. If you need a test environment, contact us and we will provide one.