We read your code to review it, and store none of it.
heygrc reviews pull requests for compliance, so the obvious question is what happens to the code it reads. The short answer: secrets are stripped first, the diff is processed transiently, and your source is never retained. heygrc is a product by ISMS Copilot and shares its security and legal posture.
Data handling, in plain terms.
- Secrets are stripped before review
Sensitive files (.env, keys, anything that looks like credentials) are dropped, and secret-shaped content (private-key blocks, API tokens) is redacted, before a diff is ever sent to the model.
- Your source is reviewed, not retained
The diff is processed transiently to produce the review. heygrc stores only the review it writes back (the summary and findings), never your source code or the raw diff.
- EU-hosted worker
The review worker runs in the EU (Paris). That is the control plane for your job queue and GitHub API calls. It is not the same as where the model inference runs (see below).
- Default inference path
By default, reviews use the same OpenRouter allowlist as ISMS Copilot: a closed set of vetted providers with zero retention and no training, and PRC-jurisdiction hosts blocked at the account level. Inference region is not contractual EU residency on this path; formal transfer details are in the DPA.
- Optional EU inference
Organizations can enable EU inference in the heyGRC console. When on (and platform-enabled), compliance reviews are sent to Mistral on the EU regional endpoint instead of the default path, with no silent fallback to global models. GitHub remains the source of pull request content. Quality and large-PR coverage may differ.
- Least-privilege by design
The GitHub App requests only the permissions it needs, API keys are stored as one-way hashes, and a key can only ever act on its own organization.
- It never blocks your merges
heygrc posts a neutral Checks status and comments. Findings are surfaced for you to weigh, not used as a gate on shipping.
- Optional website support chat (third party)
When enabled, marketing and docs may load a Chatbase AI support widget (US-hosted). Conversations can be processed by Chatbase and its model providers. Do not paste secrets or customer personal data into that chat. Prefer email to support@ismscopilot.com if you do not want US-hosted AI chat. Binding privacy and subprocessors live on the ISMS Copilot trust center; Chatbase must be listed there before the widget is turned on in production.
The binding documents live on the ISMS Copilot trust center.
heygrc does not maintain a separate legal stack. The Terms, Privacy Policy, DPA, and subprocessor list that govern heygrc are the ISMS Copilot ones, kept in one place and versioned with a public change log.
- Terms of ServiceThe service agreement.
- Privacy PolicyWhat data is processed and why, including the full AI-provider posture.
- Data Processing AgreementProcessor terms, subprocessors, and transfer mechanisms.
- Register of Processing ActivitiesThe per-activity Article 30 processing inventory.
- Cookie PolicyHow the sites use cookies.
Questions a security review or vendor assessment did not answer here? The full trust center has the Transfer Impact Assessment, status page, and contact for security inquiries.