MergeGuard - AI Protection for every Pull Request

Transparency

Security & infrastructure

What we run, who we call, and how we keep pull-request analysis predictable for security-minded teams.

How it worksSecurity contactChangelog

Powered by

  • OpenAI
  • Anthropic
  • GitHub
  • GitLab
  • Railway

Runtime

MergeGuard web and API services run on Railway with isolated containers, rolling deploys, and environment-scoped secrets.

GitHub App

Fine-grained installation permissions, per-repo access, and short-lived tokens. No broad OAuth password grants for org code.

AI providers

Reviews are generated through OpenAI and Anthropic APIs. Prompts include only the diff and metadata you send to MergeGuard—no unrelated corpus training on your behalf.

Encryption

TLS 1.2+ for every browser and GitHub webhook call. Secrets and keys live in managed secret stores, not in the repo.

Uptime

Hosted on the same regional edge patterns Railway recommends for production Node services. We monitor webhook success and API latency continuously.

Data handling

Review payloads are processed in memory for the request lifecycle. Retention policies follow your plan tier; contact us for DPA and enterprise controls.

At a glance

Hosts
Railway · managed TLS
Integrations
GitHub App + webhooks
Models
OpenAI · Anthropic (routed)
Status
Synthetic checks + delivery logs

Trust center

MergeGuard is built for teams that need predictable data handling on pull-request diffs—not broad org-wide access. We process review payloads in memory for each request and store only workspace metadata, usage, and support leads you submit through the product.

  • Least privilege. GitHub App and GitLab OAuth scopes limited to review and fix workflows.
  • Encryption in transit. TLS for browser, webhook, and provider API traffic.
  • No training on your code. Prompts use your diff and metadata only for that review request.
  • Enterprise questions. DPA and security questionnaires via contact.

Product changes are published on our changelog.

Security FAQ

Common data-handling and infrastructure questions from engineering and security teams.

How does MergeGuard handle customer data?

Review jobs use scoped GitHub App or GitLab project access, TLS for all traffic, managed secrets, and in-memory processing for the diff under review—not your full org codebase. Contact us for security questionnaires or DPAs.

What data does MergeGuard send to AI providers?

Review jobs send the pull request diff and related metadata needed to generate findings—not your full org codebase. Prompts are scoped to the PR/MR under review.

How are GitHub permissions scoped?

MergeGuard uses the official GitHub App model: you choose which repositories to install on, with revocable, least-privilege access per installation.