Security
You give us access to your repos. We take that seriously.
We sell security. So Stackwatch itself has to set the example: in hosting, privacy, access rights and on this website. Here is how we do it.
Our principles
Hosted in Germany
All data stays in German data centers. This website is served from a server in Germany as well.
100% GDPR compliant
We sign a data processing agreement (DPA) under Art. 28 GDPR with you. No sharing of your data, no trackers.
ISO 27001 certified
Riddle Technologies AG is ISO 27001 certified. Processes, access and incident handling are audited, not just promised.
Read-only
We read manifests, configs and the parts of your code that show how your software runs. Never secret values, no write access.
GitHub permissions
As little access as possible. Only for the repos you select.
| Scope | Access |
|---|---|
| Repo contents of selected repos | Read only |
| Metadata of selected repos | Read only |
| Write code, push, change branches | No access |
| Issues | No access |
| Pull requests | No access |
| Repo and organization settings | No access |
What we read
We read what describes your stack. And how your code uses it.
What we analyze
- Manifests and lockfiles
- Dockerfiles, CI and infra configs
- Web server configs
- Code such as routes and entry points
What we never process
- Secret values (removed before analysis)
- Training AI models on your code
- Write operations of any kind
Data storage and evidence
Data storage
We store what we need for your alerts: your stack map with components, versions and evidence, the alerts and the audit log. All data stays in Germany.
Audit log
Every alert, every acknowledgement, every status change with timestamp and person. Exportable as CSV and PDF, for ISO 27001 and NIS2 audits.
This website
Served statically, without cookies, without analytics, without external fonts or CDNs. Strict Content Security Policy and HSTS. The only external component is the waitlist form by Riddle, also a product of Riddle Technologies AG.
Responsible disclosure
Found a vulnerability?
Thank you for looking. Write to security@stackwatch.de and describe the issue, if possible with steps to reproduce. Please give us time to fix the issue before you publish details, and do not access third-party data while testing.
Our contact details are also available in machine-readable form at /.well-known/security.txt (RFC 9116).