Security

This page tells you how Squasher protects the data that you send to it. It also tells you what the Squasher agent can do in your code repository and how to report a security problem.

The companies that process data for us are listed on squasher.ai/subprocessors. How we use personal data is in the Privacy Policy at squasher.ai/privacy.

Squasher stores the data of every project in the United States. We do not offer another data region today.

The API, the ingest service, the event database, and the Postgres database run in the AWS us-east-1 region (N. Virginia). Session replays and source maps are stored in Cloudflare R2, with the storage location set to eastern North America.

The website, the dashboard, the API, and the ingest endpoints accept connections over HTTPS. A plain HTTP request gets a redirect to HTTPS. The website and the dashboard send a Strict-Transport-Security header.

Our AWS load balancer accepts traffic only from Cloudflare's network. Connections to the Postgres database use TLS. Our storage buckets in AWS refuse requests that do not use TLS.

The event database has no public address. It is on a private AWS network, and only our own services can connect to it.

The disks of the event database are encrypted with AWS EBS encryption, and so are their snapshots. Ingest batches that we hold for retry are stored in an encrypted S3 bucket and deleted after 14 days.

Our Postgres provider and Cloudflare R2 encrypt the data that they store.

We store API keys only as SHA-256 hashes, so we cannot read a key after we show it to you once. Access tokens for connected providers, Slack bot tokens, and AI provider keys that you add are encrypted before we store them.

Each organization has roles: owner, admin, security admin, billing admin, and member. Members can read project data. Owners and admins can also change projects, monitors, incidents, and status pages. Security admins manage integrations and security settings. Billing admins manage billing.

You can sign in with an email link, GitHub, or Google. Organizations can set up single sign-on with a verified email domain, provision users with SCIM, and require single sign-on for all members. Sign-in requests have a rate limit.

Squasher keeps an audit log of organization changes: organization creation, rename, and deletion, invitations, new members, and role changes.

No one connects to the event database server over SSH. The server has no SSH access. Operators use AWS Systems Manager Session Manager, which requires AWS sign-in.

Deployments run in CI with short-lived AWS credentials that work only for this repository, environment, and workflow. Production secrets are kept in AWS Secrets Manager and Cloudflare Worker secrets, not in source code.

AI triage only reads. It reads the issue, its latest events, and the project's issues, events, logs, traces, metrics, and deployments. It does not change data and it does not read your code.

When the agent runs code against the Squasher API, the code runs in a new isolated worker for each call. That worker has no network access. It can call only the Squasher API, with the permissions of the person or API key that started it. Each run has limits on time, API calls, and output size.

When you ask Squasher to fix an issue, the agent clones your repository into a new sandbox for that one run. The sandbox can connect only to GitHub. We do not put AI provider keys or Squasher secrets in the sandbox. A sandbox stops after 30 minutes without activity, and we delete it within four hours.

Each agent run has limits on time, tool calls, and AI spend. A run stops when it reaches a limit.

The Squasher GitHub App asks for these permissions: read metadata, checks, and commit statuses, and write repository contents and pull requests. You choose the repositories that it can access when you install it.

For each fix, the agent gets a GitHub token that works for one repository only and expires after one hour. The agent pushes its changes to a new branch whose name starts with squasher/fix-, and it opens a draft pull request. It opens the pull request only after a separate run of your tests passes.

Squasher never merges a pull request. A person on your team reviews and merges it. Because the app can write repository contents, we recommend branch protection on your default branch.

AI requests go to model hosts through OpenRouter. The hosts are listed on squasher.ai/subprocessors. Squasher does not train or fine-tune AI models on customer data.

The Privacy Policy tells you which requests require hosts that keep no data and do not train on it.

We take an encrypted snapshot of the event database disk every day and keep each snapshot for 7 days. We back up the Postgres database every 12 hours and keep each backup for 2 days. All backups stay in the AWS us-east-1 region.

Email support@squasher.ai with Security in the subject line. Tell us the affected URL or component, the steps to reproduce the problem, and what you saw. Do not include secrets or other people's data.

Test only with accounts and data that you own. Do not access, change, or delete the data of other customers, and do not run tests that slow down or stop the service. We do not run a paid bug bounty program.