Security you can take
to your security team.
Enterprise-grade security is table stakes, not a selling point. Here's exactly how Koalr handles your data, who can access it, and what we're working toward on compliance.
Infrastructure overview
Hosted on Oracle Cloud
US-based cloud infrastructure. All services — frontend, API, database, and analytics — run on Oracle Cloud Always Free VM in the US Midwest (Chicago) region. No data leaves US-based data centers.
PostgreSQL + Redis
All data encrypted at rest using AES-256. Daily automated backups with point-in-time recovery. Isolated per-tenant database schemas.
Anthropic AI
Your data is never used to train Anthropic's models. Per Anthropic's API terms, data sent via the API is not retained for model training purposes.
What Koalr accesses
What we read
- ↳Pull request metadata (title, author, timestamps, review status)
- ↳Deployment events (deployments, status, environment)
- ↳Incident and alert data (PagerDuty, OpsGenie, Incident.io)
- ↳Code coverage reports (Codecov, SonarCloud)
- ↳CODEOWNERS file structure
- ↳Commit metadata (hash, author, timestamp, files changed — not content)
What we never read
- ✕Source code file contents
- ✕Secrets, credentials, or environment variables
- ✕Pull request diffs or code review comments
- ✕Passwords or API tokens from your repositories
- ✕Private repository contents beyond commit metadata
How the risk model learns — and what it never sees
Koalr sees patterns, not your data.
Off by default — always your call
Contributing deployment patterns to the global risk model is opt-in only and disabled by default. No organization contributes to model calibration without explicit consent from an admin. Toggle it on or off at any time in Settings.
Patterns, not content
If your organization opts in, Koalr observes statistical patterns — for example, “IaC changes on Fridays correlate with incidents more often at this organization.” That's a pattern. Your source code, PR descriptions, commit messages, file contents, author names, and repository names are never read — by the model or anyone at Koalr.
Your environment is sealed either way
On or off, your deployments, PRs, and settings are never accessible to other organizations. Tenant isolation is enforced at the API layer on every request — this is not a policy, it's a hard technical boundary. The toggle only controls whether observed statistical patterns from your deployments contribute to refining the shared risk model.
Admins can change this at any time in Settings → General → AI & Data Control inside the app. The change takes effect immediately.
Authentication
Custom JWT authentication
SAML SSO (and OIDC) is available on the Business plan for organizations that require centralized identity providers.
JWT-based API authentication
Every API request is authenticated using short-lived Ed25519-signed JWTs. Tokens are verified server-side on every request. There are no long-lived API keys exposed to clients.
Organization-level data isolation
Each organization's data is completely isolated. A user from Org A cannot access data from Org B under any circumstance — enforced at the API layer on every request via tenant isolation middleware.
Compliance roadmap
| Standard | Status | Details |
|---|---|---|
| GDPR | In progress | DPA available on request. Subprocessors listed at /legal/subprocessors. |
| SOC 2 Type II | Planned | Evidence collection starting Q2 2026. Report expected Q4 2026. |
| HIPAA | Not applicable | Not applicable — Koalr processes no health data. |
| PCI DSS | Not applicable | Not applicable — Koalr processes no payment card data. |
| Data Privacy Framework (DPF) | In progress | Self-certification in progress. |
Subprocessors
Full list available at /legal/subprocessors. We will notify customers of any new subprocessors 30 days in advance.
| Subprocessor | Purpose | Location |
|---|---|---|
| Oracle Cloud | Full-stack hosting: frontends, API, database, and analytics | USA |
| Anthropic | AI language model (Claude) | USA |
| GitHub | OAuth and source control integration | USA |
| Atlassian (Jira) | Project management integration | USA |
| Cloudflare | CDN and DNS | Global / USA |
Responsible disclosure
How to report
Email [email protected] with a description of the vulnerability, steps to reproduce, and the potential impact. Please do not publish or share details publicly until we have had the opportunity to investigate and remediate.
Our commitments
- ↳We will acknowledge your report within 48 hours.
- ↳We will provide a status update within 7 days.
- ↳Critical vulnerabilities will be remediated within 14 days.
- ↳We will not pursue legal action against researchers acting in good faith.
- ↳We will credit you in our hall of fame unless you prefer anonymity.
Scope
In scope: app.koalr.com, api.koalr.com, koalr.com, and the Koalr GitHub App. Out of scope: social engineering, physical attacks, denial-of-service, and attacks against third-party infrastructure not controlled by Koalr.
No monetary bounties
Koalr is pre-revenue and does not offer cash bounties at this time. We offer public recognition in our hall of fame and a sincere thank you for helping keep our users safe.
Security questions?
Reach our security team at [email protected].