Security
Last updated October 23, 2026
The short version
Sirro stores the assets your coding agents save and fetch, and the accounts and workspaces around them. Everything travels over TLS and sits in an encrypted database in the United States. Passwords are hashed with bcrypt; every session token, agent token, API key and invitation is stored only as a hash. An agent reaches a workspace only through a connection you approved in the browser, and that connection is checked against your live membership on every request. We do not sell data, we do not train models on your library, and we do not have an analytics tracker on the site.
Where your data lives
The application runs on Vercel and the database is PostgreSQL on Neon, both in the United States. Connections between your browser or agent and Sirro, and between Sirro and its providers, use TLS. Data at rest is encrypted by the hosting providers. Database backups are kept by Neon for point-in-time recovery over a rolling window.
Sirro has no field-level encryption on library content: the code and documents you save are readable to the database, the way they are in any code host. Do not save secrets in a library.
Subprocessors
These companies process data on our behalf. We will update this list before adding one; enterprise customers with a data processing agreement are told in advance.
| Provider | Purpose | What they see | Where |
|---|---|---|---|
| Vercel | Hosts the application and runs its code | Everything the application handles, in transit | United States |
| Neon | PostgreSQL database | Accounts, workspaces, library content, billing records | United States |
| Resend | Sends email | Email addresses and the messages we send (sign-in codes, invitations, invoices) | United States |
| Upstash | Rate limiting | Hashed request identifiers with short expiry; no content, no addresses | United States |
| Sentry | Error reports | Error messages and stack traces; request bodies, headers, cookies and user details are stripped before sending | United States |
| Stripe | Payments and invoicing | Billing contact, invoices and payment details; card numbers never touch Sirro | United States |
| GitHub | Source code and continuous integration | No customer data | United States |
How access works
- People sign in with a six-digit code emailed to them (ten minutes, five attempts, single use) or with a password hashed with bcrypt. Sessions are stored server-side as hashes and end on sign-out.
- Coding agents connect through OAuth with PKCE. You approve the connection in the browser and choose the workspaces. The agent receives a short-lived access token and a refresh token; a refresh token presented again after a short grace revokes the whole connection. Disconnecting in Sirro ends an agent's access at once.
- Every agent request re-checks that the person still belongs to the workspace it is asking about. Leaving a company, or being removed, takes effect on the next request.
- Inside a company workspace, owners and managers run the people; members use the library. Only an owner sees billing.
- Sirro staff reach company settings through an internal console. Every change staff make to a company is written to that company's activity log, which the company owner can read.
What we keep, and for how long
| Data | Kept |
|---|---|
| Your account and library | While the account exists. Deleting your account removes it, along with your personal workspace and agent connections. |
| A company workspace | While the company is a customer. A deleted company is purged after 30 days, including its members' copies of company files. |
| Sign-in and authorization codes | 1 day after they expire |
| Expired browser sessions | 1 day |
| Tokens of a disconnected agent | 30 days, so a stolen token presented later is still recognised |
| Agent activity in a library (saves and reuse) | 180 days |
| Error reports | Per Sentry's retention; they contain no request bodies, headers or user details |
| Invoices and payment records | As long as accounting law requires |
A daily job enforces these limits.
Deleting data
Anyone can delete individual assets, disconnect agents, and delete their account from inside the product. A company owner can ask us to delete the company; we confirm, delete, and purge after 30 days. Requests about personal data, including export, go to hello@sirro.dev and are answered within 30 days.
How we work
- Every change to Sirro goes through a pull request with automated tests, a dependency vulnerability audit, and a check that every API route declares how it is protected.
- Production runs only from the main branch; secrets live in the hosting provider, never in the code.
- We review the whole application for security gaps and keep the findings and their status in the repository. The last review was on 22 October 2026.
- An external penetration test and SOC 2 Type I are planned. Sirro is not yet certified; we say so rather than imply otherwise.
If something goes wrong
If we confirm a breach affecting your personal data or your company's library, we notify the affected account owners by email without undue delay and within 72 hours, with what happened, what was affected, and what we did. Found a vulnerability? Email hello@sirro.dev; we reply within two working days and will not take action against good-faith research.
For enterprise customers
A data processing agreement with the standard GDPR terms, the subprocessor list above, and this security summary is available on request. We answer security questionnaires from the facts on this page. Contact hello@sirro.dev.