Security & Trust

Enji Guard works with the repositories you connect and, for active checks, the website and API targets you authorize. It does not request access beyond what you select.

Repository access is scoped to the repositories you select through the GitHub App, and verified before a task uses a repository. Write permissions are used only for enabled GitHub outputs such as issues, pull-request branches, pull requests, and comments on issues and pull requests. You can revoke access at any time in your GitHub settings.

Repository-backed tasks run in isolated, ephemeral containers. After a task completes, the container is shut down and removed together with the cloned repository code.

Provider credentials and other secret material are stored encrypted, and access to them is restricted. Task logs are masked by default to avoid capturing secrets, tokens, raw authorization headers, or model-provider credentials.

Selected task context may be processed by approved third-party AI and coding providers under their own terms. Customer content is not used to train Enji-owned models. See the AI Data Use page for details.

Access to customer content by our team is limited to support, security, incident response, and abuse prevention, on a need-to-know basis.

Enji Guard does not currently hold SOC 2, ISO, or similar certifications. We will state any certification on this page once the corresponding audit exists.

To report a security concern or suspected vulnerability, contact [email protected]. See the Vulnerability Disclosure page for what to include.