Data processing
Last updated: 29 October 2026
When your organisation uses Stackat, it is the controller of the personal data in its repositories and we process it only on its behalf. Every plan, trial and free plan included, comes with our Data Processing Agreement under Art. 28 GDPR. Ask info@progrex.dev for a copy to review or sign.
What we process
| Item | Description |
|---|---|
| Whose data | Your employees and contractors who use GitHub: repository contributors, people who comment on Stackat's issues |
| Which data | GitHub usernames and account ids (stored only as pseudonyms); comments addressed to Stackat; personal data that may appear in repository files, which is processed only while a scan runs and deleted when it finishes |
| Purpose | Scan infrastructure repositories for tool versions and report upgrade risks as GitHub issues and pull requests |
| How long | Repository files: until the scan finishes (seconds). Scan results: until the next scan. Everything: deleted 90 days after you remove the GitHub App, or at once when you ask (a copy first, if you want one); backup copies age out within 12 months. |
How we protect it
- Least access: the GitHub App asks for the fewest permissions that do the job, on the repositories you choose.
- No code kept: repositories are deleted as soon as each scan finishes; only tool names, versions and file positions are kept.
- Pseudonyms: names are replaced by keyed hashes everywhere, including logs. Real names are only kept sealed with a key held offline.
- No secrets read on purpose: Kubernetes Secrets are skipped, and from configuration only key names and true/false settings are kept.
- No AI on your data: the AI model only reads public release notes.
- Closed server: no inbound ports; access only through Cloudflare Tunnel with email verification and an admin password; automatic security updates; containers run without root.
- Encrypted backups, tested changes with automatic rollback, and monitoring that alerts us within minutes.
Details on the security page.
Subprocessors
| Subprocessor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Secure network access to our server; encrypted backup storage | Global network; backups in the EU |
| Slack Technologies | Operator notifications (pseudonyms only) | USA |
GitHub is your organisation's own provider and Stackat acts inside your account there. Anthropic, the AI provider, receives no personal data. We give 30 days' notice by email before adding a subprocessor, and you may object.
Breaches and your rights requests
We notify you without undue delay, at the latest within 48 hours of becoming aware of a breach affecting your data, and we help you answer requests from the people whose data it is.