Access belongs to your project
The platform checks authenticated project ownership for supported evidence and configuration requests. Project ingestion keys are separate from dashboard and agent authorization. Revoke credentials and remove integration access when they are no longer needed.
CLI sign-in authenticates your agent to Everock; GitHub still requires its own authorization. Your agent can act only through the access you grant. Keep its permissions and approval rules appropriate to your application.
Reduce sensitive data at the source
The SDK sanitizes supported URLs and common secret-bearing fields and provides application-specific filters. Replay is optional with input masking and configurable DOM masking. Consent controls can disable capture categories before transmission.
Review your event messages, payloads, and rendered application. A custom identifier, log line, or DOM element can still contain sensitive information that a general redactor cannot infer.
Separate code access from runtime evidence
A repository connection provides authorized source context. SDK installation provides observations from a running application. An architecture summary can be published from a local checkout without uploading its complete contents.
Some optional operator-run repository-analysis paths can access repository content. Review the enabled deployment and permissions; do not assume every code feature is local-only or that connecting GitHub installs runtime monitoring.
Collection and credential protections
These are implementation boundaries, not a claim of universal encryption at rest, zero vulnerabilities, or an independently audited environment.
- Bounded payloads, ingestion quotas, and rate controls help limit abuse and accidental event storms.
- Active availability checks validate destinations to reduce access to private or infrastructure networks.
- Selected integration and environment secrets are encrypted by the server; production requires private authentication and encryption configuration.
- HTTPS, storage protection, backups, restoration, and operational monitoring must be verified for the actual deployment.
Report a vulnerability privately
Use the Security topic in the contact form for a short, redacted report describing the affected feature, impact, and safe reproduction steps. Do not access another customer’s data, disrupt service, or send exploit payloads containing real personal data.
No bounty, guaranteed response time, or legal safe-harbor program is offered by this overview. A coordinated disclosure process and monitored security contact must be finalized for the public service.
Assurance without assumptions
Everock is in beta. There is no verified SOC 2 report, ISO 27001 certificate, HIPAA BAA, or completed compliance assessment available from this page. The compliance overview explains what remains to be established.
