/ data security /
What data do we store?
Updated Sep 24, 2026
As a SOC2 Type II certified organization, Allstacks stores only the data needed to deliver insights about your organization: metadata from your tools and, for connected code repositories, a copy of your source code and the indexes derived from it.
Source code is stored to power code search, code-aware AI features, and analysis across your repositories. It is encrypted at rest, isolated per customer, and processed only by Allstacks and our sub-processors. Our current sub-processor list is available on request at security@allstacks.com. Customers may request that source code storage be disabled for their organization. We do not access or store private communication.
What data do we store?
From each of your tools, we do store the following data for the purpose of data presentation:
- Usernames and/or email addresses,
- Repository Metadata (including: Project identifying information and statistics, pull request identifying information and statistics, commit identifying information and statistics, and issue identifying information and statistics),
- Source code from connected repositories, including file contents and code comments, and derived artifacts such as code indexes, symbol maps, and embeddings,
- Project Management Metadata (including project identifying information and statistics, issue identifying information and statistics, and user access statistics).
- Unstructured communication on public forums and channels (Messages and comments)
What do we not store?
- Budget or financial information
- Documentation or documentation contents, other than files stored in connected code repositories
- Customer information (Unless added as a part of information we store above)
- Personal information of customers, clients, or external parties. (Unless added as a part of the information we store above)
- Private communication
Most personally identifying information, including:
All stored data is encrypted at rest in our cloud offering. Data handling for custom integrations and on premise installations is dependent on the provided hardware, infrastructure, and provider policies.
- Home address
- National identification number
- Passport number
- IP address
- Vehicle registration plate number
- Driver’s license number
- Face, fingerprints, or handwriting
- Credit card numbers
- Digital identity
- Date of birth
- Birthplace
- Genetic information
- Telephone number
- Country, state, postcode or city of residence
- Age, especially if non-specific
- Gender or race
- Name of the school they attend or workplace
- Grades, salary, or job position
- Criminal record
Trusted by
Access Credentials
Some software integrations only provide a “basic” authentication structure, which requires storing a username and password for access. In these cases, we store pertinent credentials in a secured database, salted and encrypted with a key stored externally to the database.
Access tokens, API tokens, OAuth and OAuth2.0 credentials, and other connection credentials are stored in a secured database, salted and encrypted with a key stored externally to the database.
Access credentials are persisted unless the user removes the connection to the service. This allows Allstacks to consistently update and refresh our data to provide you with the most accurate and timely view of your data.
How we process metadata
Allstacks processes data from a very large number of sources and takes your data privacy and sensitivity very seriously. After explicitly granting access to each tool, Allstacks downloads specific data sets for processing. Each data set undergoes a two-step process where (1) each download is scanned, and relevant metadata is stored in a persistent database. (2) This metadata is then processed to identify key metrics and insights, which are stored and presented on the platform.
Where is your physical infrastructure?
Allstacks stores customer data with Amazon Web Services or Microsoft Azure, depending on the customer’s deployment, and benefits from the secured, distributed, fault-tolerant environments these providers offer. Detailed information on their security practices can be found at https://aws.amazon.com/security/ and in the Microsoft Trust Center.
Most personally identifying information, including:
All stored data is encrypted at rest in our cloud offering. Data handling for custom integrations and on premise installations is dependent on the provided hardware, infrastructure, and provider policies.
- ISO 27001
- SOC 1 and SOC 2/SSAE 16/ISAE 3402 (Previously SAS 70 Type II) PCI Level 1
- FISMA Moderate
- Sarbanes-Oxley (SOX)
What security policies and procedures do Allstacks staff follow?
Allstacks restricts access to production servers and databases to a few, select, staff members. Security breaches are held as the highest level of infraction, and offenders are immediately terminated.
Allstacks supports a number of security policies that help restrict access to customers’ data:
- Data processing servers have routine access audits.
- Production datastores have routine access audits
- Credentials for Production datastores are only provided to a limited number of staff, and rotated with new staff members.
- Access is restricted to production and live data test servers to automated tools in order to minimize access levels needed by staff.
- Minimum password strength policies are in place.
Data Protection Statement Access
This document will be updated as features and security improvements are integrated into the system. An updated copy can always be obtained by contacting Allstacks at support@allstacks.com, and requesting an up-to-date copy of the data protection statement.
Resolution Avenues
All data requests can be made through the official communication channel at support@allstacks.com.
Any data can be removed upon request. This includes removal of the full set of data collected for an organization, a service, or an individual. This request should be made to the above address.
Data Retention
Customer data is not stored for longer that it is needed. We require data about employees and users to deliver accurate data visualizations, and remove this data either upon request, or after an audit period [30 days max] after the account is terminated.
Data is also removed if deemed out of date, or no longer valid. This can happen from removal of connected services, termination of accounts, or other events originating from connected service providers.
/ get started /
