Security & Data Handling
Last updated: April 22, 2026
Core principles
🔒
No persistent storage of source code
Repository file contents are read, processed in-memory to generate documentation, and discarded immediately. We store only the generated documentation — not your source code.
🚫
No training on your data
Your code and documentation are never used to train AI models — ours or anyone else's. We use Anthropic's API under terms that prohibit training on customer data.
🔑
Minimal permissions
Stacklore requests read-only access to your repositories. We never request write permissions unless you explicitly enable PR auto-commit, and even then only to a dedicated stacklore-docs branch.
🏛️
Private portals by default
Your documentation portal is private from the moment it's created. Only authenticated team members can access it. There is no public-facing documentation unless you explicitly share a link.
What we access
When you connect a repository, Stacklore accesses:
- File tree — to identify documentable files (Ansible, Terraform, CI/CD)
- File contents — read one file at a time to generate documentation
- Repository metadata — name, default branch, visibility
We do not access issues, pull requests, commit history, wiki pages, or any files outside the repository root that aren't infrastructure files.
How data flows
1
You connect a repo — Stacklore registers a webhook and begins scanning the file tree via the GitHub/GitLab API.
2
File is read — a single file's contents are fetched into memory on the Stacklore server. It is not written to disk.
3
Sent to AI — the file contents and a documentation prompt are sent to Anthropic's Claude API over an encrypted HTTPS connection.
4
Documentation stored — the AI response (the generated doc) is stored in Stacklore's database. The source file contents are discarded.
5
Served to your team — the generated documentation is served through your private portal, accessible only to authenticated members.
AI processing
Stacklore uses Anthropic's Claude API to generate documentation. This means relevant portions of your infrastructure files are transmitted to Anthropic's servers for processing.
Anthropic's API usage policy prohibits using customer data to train models. You can review their privacy policy and usage policy.
Self-hosted AI option: If you have privacy requirements that prevent sending code to Anthropic, you can configure a custom AI model URL and API key in your org settings. This routes all processing through your own AI provider (e.g., a locally hosted model) instead.
Access control
- Authentication — all API requests require a signed JWT. Sessions expire after 7 days.
- Portal access — portals are private by default. Access requires an invite link or owner approval.
- OAuth tokens — GitHub/GitLab tokens are encrypted at rest and used only to access your connected repositories.
- Role-based access — owner, member, and viewer roles control what team members can see and do.
- Rate limiting — login and registration endpoints are rate limited to prevent brute force attacks.
Infrastructure security
- Hosted on Linode (Akamai Cloud) in a dedicated server environment
- TLS 1.2+ enforced on all connections via Let's Encrypt certificates
- Database and Redis ports are bound to
127.0.0.1 only — not exposed to the internet
- Application runs as a non-root user inside Docker containers
- Webhook payloads are verified using HMAC signatures before processing
- Passwords are hashed with bcrypt (cost factor 12)
Best practices for you
To get the most security from Stacklore:
- Never commit secrets — API keys, passwords, and tokens should be in environment variables or a secret manager, not in repository files that Stacklore (or anyone else) might read
- Use
.gitignore — ensure .env files and secrets are excluded from your repository
- Review generated docs — before sharing portal access broadly, review the generated documentation to confirm nothing sensitive was inadvertently captured
- Revoke OAuth access when done — you can revoke Stacklore's GitHub/GitLab access from your provider's settings at any time without losing your generated documentation
- Use the self-hosted AI option for repositories containing highly sensitive proprietary infrastructure
Security disclosure
If you discover a security vulnerability in Stacklore, please report it responsibly to hello@stacklore.io before disclosing publicly. We will acknowledge reports within 48 hours and work to resolve confirmed issues promptly.