Security

• The Aevral GitHub App holds these permissions: Contents read and write, Issues read, Metadata read, Checks write, and Pull requests read and write. It receives pull request and issue comment events. It has no administration, secrets, workflows or deployments permission. Issues read was added on 2026-10-01 for the review command, which acts on issue comment events; no Aevral token carries it. Contents write was added the same day for the announced standard sync below; no code uses it yet.

  Reported by the running service

• Every token Aevral mints is capped below what the App holds: Contents read, Metadata read and Checks write, plus Pull requests write for pull request reviews. No token Aevral mints carries Contents write or Issues access.

  Verified in code

• Each scan or pull request review gets its own GitHub token, minted for that job, limited to one repository and capped as described above. Tokens live in memory only, expire after GitHub's default of one hour, and are never stored.

  Verified in code

• One stated exception: refreshing the list of repositories you selected uses an installation-wide token with the same capped permissions. No other part of Aevral can obtain an installation-wide token.

  Verified in code

• Aevral writes to your repositories only as advisory check runs and pull request review comments submitted as comments. It never commits, pushes, creates branches, merges or approves. Suggested fixes are text only.

  Verified in code

• Every GitHub webhook is verified with an HMAC-SHA256 signature over the raw body, compared in constant time, and its size is capped before it is read. Aevral acts on installation, repository selection and pull request events, and on issue comment events only for the review command; any other issue comment is ignored.

  Verified in code

• Commenting @aevral review at the start of a new comment in the pull request conversation asks Aevral to review the whole pull request again. It acts only for the repository owner, a member of its organization or a collaborator, as GitHub marks them, never for a bot. The same commit can be re-reviewed at most 3 times, at least 10 minutes apart, not while a review runs, and is not counted again. A newer push that was not reviewed automatically, because of the repository's review trigger setting or the per-pull-request automatic limit, is reviewed when you comment and billed like any other push.

  Verified in code

• Scans read one archive of your repository at a single fixed commit. Pull request reviews read the diff, plus full files at the head commit for some changed files. Both have size limits. Code is processed in memory on a server in Paris. No customer code is executed, and the model has no tools or shell.

  Verified in code

• The worker runs in the Deno sandbox with outbound network limited to a list of hosts and environment access. It has no permission to write files, run subprocesses, load native code or read system information, and it loads no code at run time beyond what the image cached when it was built.

  Verified in code

• Outbound network from the worker is limited to an exact list of hosts in these categories: GitHub, the model providers, the EU database, error monitoring, payments and alerting. A call to any other host is refused by the sandbox.

  Verified in code

• The worker has no write access to disk at all, not even to a temporary folder. Repository archives are read in memory.

  Verified in code

• Scans leave out files whose paths look like secrets and redact credential patterns in the code they send. Pull request reviews hold back sensitive files and name them in the Check as not sent. Detection is pattern-based.

  Verified in code

• Code excerpts in findings are shown in the Aevral console and, when you connect an AI tool through MCP, returned to that tool. Where that tool processes them is set by the tool you choose.

  Policy

• Aevral data is stored in a Supabase database in the EU (Frankfurt). Row level security is on for every Aevral table exposed through the database API and limits access to members of your organization; internal tables sit in a schema the API does not expose. The worker uses its own database role without row level security bypass, which may only call a fixed list of functions and holds no direct table access, and it refuses to start with any other role's key.

  Verified in code

• Data is encrypted in transit with TLS and encrypted at rest in the database, as committed in the security measures of the Data Processing Agreement (section 2.3). The worker is served over HTTPS only; plain HTTP is redirected.

  Policy

• Automatic deletion runs today: worklist findings 24 months after last seen; 12 months after a repository is removed or the App is uninstalled, its scan reports, pull request review content, findings and repository name, and the account and installer logins and ids on the installation record (the installation number and dates stay); audit log entries 12 months after the organization is deleted, and all after 24 months; disconnected AI tool connections 90 days after disconnect.

  Verified in code

• Customer data is kept while Aevral is installed and for up to 12 months after uninstall, and deleted on request within 30 days. The Data Processing Agreement, section 1.7, is binding.

  Policy

• Aevral API keys are stored only as SHA-256 hashes and looked up by hash.

  Verified in code

• An append-only audit log records the scan lifecycle and team changes.

  Policy

• New capabilities ship switched off in code and stay off unless turned on separately for the running worker: the MCP connection, MCP scans, the review command and EU-only processing. The running worker reports each switch publicly.

  Verified in code

• The current state of the MCP connection, MCP scans, the review command, standards sync writes and EU-only processing is read from the running worker.

  Reported by the running service

• When Aevral uses OpenRouter, every request is restricted to a closed list of hosting providers, with data collection denied and zero data retention required. The list is never widened without a sub-processor notice.

  Verified in code

• Scans and pull request reviews run on GLM-5.3 or GLM-5.3 Flash through OpenRouter, depending on the job and plan, pinned to three hosting providers listed on the Aevral sub-processor page: Together AI (US), Fireworks AI (US) and Inceptron (Sweden). Inceptron does not currently serve these models, so in practice requests are processed in the US. The running worker reports its rail and model ids publicly.

  Reported by the running service

• Repository content is treated as untrusted data in prompts. Model output is neutralized before it is posted, and every finding must match the code verbatim.

  Verified in code

• Your code is not used to train models. Each model request asks the provider not to collect or retain data; the account-level setting is attested by the provider.

  Policy

• No single sign-on (SSO or SAML) for the console yet.

• No multi-factor authentication in the Aevral console yet.

• After uninstall, the organization account, its billing records and scan and review metadata (commit ids, dates, status, no code) are kept until the account is deleted. Deletion is honored on request.

• No independent penetration test of Aevral yet.

• No certification yet.

• EU-only processing is announced, not live.

• Secret detection is pattern-based and can miss secrets that do not match a known pattern.

• Small team, with documented continuity. Details on request.

Changes we will make, listed before they ship. None of these is live yet.

Posture changelog

1. 2026-10-02 · f20ba97a2

   • Reworded: Automatic deletion runs today: worklist findings 24 months after last seen; 12 months after a repository is removed or the App is uninstalled, its scan reports, pull request review content, findings and repository name, and the account and installer logins and ids on the installation record (the installation number and dates stay); audit log entries 12 months after the organization is deleted, and all after 24 months; disconnected AI tool connections 90 days after disconnect.
   • Gap listed: After uninstall, the organization account, its billing records and scan and review metadata (commit ids, dates, status, no code) are kept until the account is deleted. Deletion is honored on request.
   • Gap closed: No automatic deletion after uninstall yet. Deletion is honored on request.
   • Gap closed: Scan reports and pull request review records have no automatic time limit yet.
   • Gap closed: The audit log has no automatic purge yet.

2. 2026-10-01 · 898916bf7

   • Reworded: The Aevral GitHub App holds these permissions: Contents read and write, Issues read, Metadata read, Checks write, and Pull requests read and write. It receives pull request and issue comment events. It has no administration, secrets, workflows or deployments permission. Issues read was added on 2026-10-01 for the review command, which acts on issue comment events; no Aevral token carries it. Contents write was added the same day for the announced standard sync below; no code uses it yet.
   • Reworded: Every GitHub webhook is verified with an HMAC-SHA256 signature over the raw body, compared in constant time, and its size is capped before it is read. Aevral acts on installation, repository selection and pull request events, and on issue comment events only for the review command; any other issue comment is ignored.
   • Now live: Commenting @aevral review at the start of a new comment in the pull request conversation asks Aevral to review the whole pull request again. It acts only for the repository owner, a member of its organization or a collaborator, as GitHub marks them, never for a bot. The same commit can be re-reviewed at most 3 times, at least 10 minutes apart, not while a review runs, and is not counted again. A newer push that was not reviewed automatically, because of the repository's review trigger setting or the per-pull-request automatic limit, is reviewed when you comment and billed like any other push.
   • Reworded: New capabilities ship switched off in code and stay off unless turned on separately for the running worker: the MCP connection, MCP scans, the review command and EU-only processing. The running worker reports each switch publicly.
   • Announced: Design review of plan documents (a design doc, spec, ADR or PLAN.md) in documentation-only pull requests. For it, Aevral also reads the repository file tree and up to 3 dependency manifests, and sends the plan text, file paths and dependency names to the model (the smaller flash model on the same pull request rail and hosts). Its questions quote the plan, and gaps it reports as not covered are checked by code against the document, not by a verbatim code match. Posted as a pull request review comment and a neutral check. It ships switched off.

3. 2026-10-01 · 0c47cd225

   • Reworded: New capabilities ship switched off: the MCP connection, MCP scans, the review command and EU-only processing are off unless turned on for the running worker. The running worker reports each switch publicly.
   • Reworded: An organization setting, changed only by an owner or admin, to process your code in the EU only. Scans and pull request reviews of that organization started after the change go only to a model provider in the EU. When EU processing is unavailable, jobs wait and retry in the EU for up to 6 hours, then end not reviewed at no charge: a neutral Check on pull requests, a failed scan that is not counted. They never fall back to the US. The setting covers Aevral's own processing; findings returned through an AI tool you connect follow that tool's own processing.

4. 2026-10-01 · 9bf2ea237

   • Reworded: Scans and pull request reviews run on GLM-5.3 or GLM-5.3 Flash through OpenRouter, depending on the job and plan, pinned to three hosting providers listed on the Aevral sub-processor page: Together AI (US), Fireworks AI (US) and Inceptron (Sweden). Inceptron does not currently serve these models, so in practice requests are processed in the US. The running worker reports its rail and model ids publicly.

5. 2026-10-01 · fdf00723b

   • Backing changed: The Aevral GitHub App holds these permissions: Contents read and write, Issues read, Metadata read, Checks write, and Pull requests read and write. It receives pull request and issue comment events. It has no administration, secrets, workflows or deployments permission. Contents write and Issues read were added on 2026-10-01 for the announced features below; no code uses them yet.
   • Added: Every token Aevral mints is capped below what the App holds: Contents read, Metadata read and Checks write, plus Pull requests write for pull request reviews. No token Aevral mints carries Contents write or Issues access.
   • Reworded: Each scan or pull request review gets its own GitHub token, minted for that job, limited to one repository and capped as described above. Tokens live in memory only, expire after GitHub's default of one hour, and are never stored.
   • Reworded: Every GitHub webhook is verified with an HMAC-SHA256 signature over the raw body, compared in constant time, and its size is capped before it is read. Aevral acts on installation, repository selection and pull request events. The App also receives issue comment events for the announced review command; the handler ignores them unless that command is switched on, and it ships switched off.
   • Reworded: The worker runs in the Deno sandbox with outbound network limited to a list of hosts and environment access. It has no permission to write files, run subprocesses, load native code or read system information, and it loads no code at run time beyond what the image cached when it was built.
   • Now live: Outbound network from the worker is limited to an exact list of hosts in these categories: GitHub, the model providers, the EU database, error monitoring, payments and alerting. A call to any other host is refused by the sandbox.
   • Added: The worker has no write access to disk at all, not even to a temporary folder. Repository archives are read in memory.
   • Added: Data is encrypted in transit with TLS and encrypted at rest in the database, as committed in the security measures of the Data Processing Agreement (section 2.3). The worker is served over HTTPS only; plain HTTP is redirected.
   • Reworded: A pull request that keeps a security standard file in your repository current. Aevral writes only to the branch aevral/standard-sync, never to the default branch, never merges the pull request, and each repository can opt out. The App already holds Contents write for this; until it ships, every token Aevral mints stays capped to Contents read.
   • Reworded: Commenting @aevral review on a pull request asks for a full review. The App already holds Issues read and receives issue comment events for this; the command is switched off.
   • Closed: shipped: Outbound network from the worker is not yet limited to a list of hosts, and the worker can still write to a temporary folder.

6. 2026-10-01 · 6cdeb1040

   Page published from the posture manifest with 23 live statements.

• We notify affected customers of a personal data breach within 48 hours of confirming it, as set out in the Data Processing Agreement.

  Policy

• Aevral is made by Better ISMS EURL. ISO 27001 certification is in progress with Aevral in the intended scope; we are not certified yet and do not have a SOC 2 report.

  Policy

• Small team, with a documented continuity and backup arrangement. Details on request.

  Policy

Data Processing Agreement

DPA (opens in a new tab) (binding; section 1.7 covers Aevral)

Sub-processors

Aevral sub-processor page (opens in a new tab)

Privacy

Privacy policy (opens in a new tab)

Report a vulnerability

Vulnerability disclosure policy and security.txt

Service status

Status page (opens in a new tab)

Security questionnaire

Questionnaire Lite (PDF). Full CAIQ or SIG on request at contact@ismscopilot.com.

Company trust center

Better ISMS trust center (opens in a new tab) (DPA, privacy policy, terms). Its security badges describe ISMS Copilot; this page is the one for Aevral.