Security
What Solemly can access, what it stores, which providers process your data, and how to report a security issue.
Last updated 19 October 2026
Access you grant
- On GitHub, Solemly is a GitHub App installed per repository: you choose which repositories it can see, and can change or remove that from GitHub at any time.
- On GitLab and Bitbucket, you connect your account or workspace, and can turn reviews off for any repository.
- Solemly reads pull request diffs and repository contents, and writes review comments, status checks and, when PR summaries are on for a repository, a section of the pull request description.
- Commands in pull request comments (such as @solemly review) only run for people with write access to the repository.
What Solemly processes and stores
| Data | How it's handled |
|---|---|
| Pull request diffs and related files | Read when a review runs and sent to an AI model provider to produce it. Prompt text isn't kept, only its size, for cost accounting. |
| Review findings and comments | Stored so you can see review history and reports, and posted back to your pull request. |
| Pull request metadata | Repository and pull request names, numbers, authors and timestamps, for history, usage limits and reports. |
| Code index | Files, symbols and references derived from the repository, used to give reviews context. Each repository keeps its two newest snapshots. Deleted when indexing is turned off for the repository, the repository is disconnected, or the app is uninstalled. |
| Account details | Name, email and workspace membership. Passwords are hashed with bcrypt; signing in with GitHub, GitLab or Bitbucket stores no password at all. |
| Payment details | Never reach Solemly. Card and UPI details are collected by Razorpay or Dodo Payments; Solemly keeps their reference IDs and a label such as “Visa •••• 4242”. |
AI models
Reviews are generated by large language models from the providers listed below, through their commercial APIs. Under those providers' commercial terms, the code sent for a review isn't used to train their models.
AI reviews can be wrong or incomplete. They're meant to help human reviewers, not replace them. A verification pass drops findings the model can't support, and blocking merges on high-severity findings is off until you turn it on for a repository.
Protecting accounts and secrets
- All traffic to Solemly is served over HTTPS.
- Access tokens and secrets for connected services (GitLab, Bitbucket, Jira, Slack, webhook secrets) are encrypted at rest.
- Webhooks from GitHub, GitLab, Bitbucket, Slack and the payment providers are verified by signature before Solemly acts on them.
- Workspaces are isolated: every request is scoped to the workspace it belongs to, with admin, member and viewer roles.
Sub-processors
Providers that process customer data to run Solemly:
| Provider | Purpose |
|---|---|
| Anthropic | AI models that generate reviews |
| Google Cloud (Vertex AI) | AI models that generate reviews |
| Amazon Web Services (Bedrock, SES) | AI models that generate reviews; transactional email |
| Razorpay | Payments for workspaces billed in India |
| Dodo Payments | Payments for workspaces billed outside India (merchant of record) |
Used only if you connect them:
| Provider | Purpose |
|---|---|
| Slack | Review notifications, if you connect it |
| Microsoft Teams | Review notifications, if you connect it |
| Atlassian Jira | Acceptance checks against linked tickets, if you connect it |
Your controls
- Choose which repositories Solemly reviews, and turn reviews, the code index, PR summaries and other features on or off per repository.
- Turning the code index off for a repository deletes its index right away.
- Uninstalling the app or disconnecting a provider stops all access and deletes that repository's code index.
- To have a workspace's data deleted, email support@solemly.com from an admin address.
Compliance
Solemly doesn't hold a SOC 2 or ISO 27001 certification yet. If you're evaluating Solemly and need details of its controls for a security review, email support@solemly.com.
Reporting a vulnerability
Email support@solemly.comwith the details and steps to reproduce. Reports are acknowledged and investigated, and customers affected by a confirmed issue are told about it. Please don't access data that isn't yours or disrupt the service while testing. Contact details are also published at /.well-known/security.txt.