OnPair

Security & data

What OnPair reads, sends and keeps.

You should know where your code goes before you pay for anything. This is the short version; the privacy policy has the long one.

  1. What OnPair can touch

    OnPair is a GitHub App. You choose which repositories it is installed on, and it sees nothing else. On those repositories it reads pull request diffs and the files you mark as documentation, and it writes check runs back to the pull request.

    Automations open a pull request on a new branch when they update docs for you. OnPair never pushes to your default branch and never merges anything.

  2. What is sent to the model

    Deterministic checks (routes, environment variables, config keys) run on our servers without a model. The documentation review pass sends OpenAI three things:

    • the pull request diff,
    • the list of changed file paths,
    • excerpts of the documentation that matched: at most 20 files, 20 KB each and 60 KB in total.

    The rest of your repository is never sent. Data sent through the OpenAI API is not used to train models.

  3. What we keep

    OnPair does not store your source code, your diffs or the contents of your docs. It keeps what it needs to show you results: the analysis summary, each finding with the file paths it points at and its suggested fix, and the token count of the model call.

    To delete everything stored for your account, email [email protected].

  4. Accounts and payments

    There are no passwords to leak. You sign in with a single-use emailed link, and only a SHA-256 hash of that link's token is stored. Every GitHub webhook is verified against its signature before it is processed.

    Payments are handled by our merchant of record. OnPair never sees or stores card numbers.