What connecting a repository actually gives us

Repository access

• A GitHub App installation you control, authorized repository by repository — there is deliberately no all-repositories shortcut
• Read-only is the default and is sufficient for the inventory, search, graph and health
• Write is a separate, explicit grant, per repository and per structure
• Revoking the installation in GitHub ends our access immediately, without involving us
• Credentials are encrypted at rest and never written to logs

Write safety

The rules that constrain what a write can do, once write-back exists.

• Never a direct push to a protected or default branch — approved changes open pull requests
• Bindings are re-resolved against the latest revision before any write is attempted
• If the source changed after the draft was created, the write stops and the conflict is shown
• Structures the serializer cannot modify deterministically stay read-only rather than being attempted

Prompt injection from repository content

Narraxio ingests arbitrary repository text by design, which makes this a primary threat rather than a footnote.

• Source text is data in a context packet, never a system instruction
• Content that reads like "ignore previous instructions" cannot change the AI layer's authority or its tool permissions
• Permissions are bound to the task mode and the acting user, not to anything the retrieved content asserts
• Ask holds no write permission at all, so a poisoned document yields a wrong answer rather than a wrong action
• Publishing requires an approval event by a human with the right, which no generated text can supply

Tenant isolation

• Content, embeddings, search indexes and assembled context are scoped to one tenant
• Cross-brand retrieval within an organization is a deliberate setting, not a default
• Nothing from one customer's graph can enter another customer's context packet

AI provider transparency

• Which providers and models may process content is disclosed on the subprocessors page
• Enterprise plans restrict which providers and models may be used
• Retention and training terms are stated as they are contractually, not as we would like them to read
• Every AI action is logged with its provider, model and inputs

Data handling

• Encryption in transit and at rest
• Configurable retention for content versions, provenance events and AI context traces
• Structured export throughout the term, so leaving is a supported path
• Deletion of the graph, indexes, embeddings and context traces within the window stated in the DPA

What Narraxio is not responsible for

The boundaries worth agreeing on before a security review, rather than during one.

• The contents of the repositories you authorize — if a repository holds secrets or personal data, connecting it means we process them
• Your source-control provider's own access controls; revoking our installation is done in GitHub, by you, and takes effect immediately
• What an approved change does once it is merged — the pull request goes through your review and your CI, which remain the gate
• Certification of your own compliance position; Narraxio provides controls and records, not a legal opinion

Related