Security & Trust Overview

Warclick analyzes GitHub activity metadata to provide engineering analytics. We intentionally limit our data collection to the minimum required for our service. Our data collection client is explicitly read-only—GraphQL mutations are programmatically blocked and will raise runtime errors if attempted.

Organization-scoped queries, authenticated membership checks and role restrictions protect tenant data. Shared accounts and lawful deidentified benchmarks have separate purposes and access controls.

• Database-level isolation. Tenant activity tables use organization identifiers, foreign keys and indexes to support data isolation.

• Query-level enforcement. Customer-facing activity queries are scoped to the authorized organization. Administrative operations and deidentified benchmarks may span organizations.

• API access validation. Protected organization endpoints apply membership and role checks. Security-relevant access failures are logged.

• Restricted disclosure. Private organization activity is subject to access controls; aggregated, deidentified benchmarks may be shared as described in the Privacy Policy.

Warclick uses GitHub OAuth for authentication, leveraging GitHub's security infrastructure rather than managing passwords directly.

• GitHub OAuth 2.0. Users authenticate through GitHub's secure OAuth flow. We never see or store GitHub passwords.

• GitHub App integration. Data collection uses a GitHub App with read-only permissions only. All permissions are read-only: repository metadata, pull requests, issues, commit statuses, and organization membership. No write access is requested or granted.

• Minimal OAuth scopes. User authentication requests only three OAuth scopes: read:user, user:email, and read:org. No repository content or admin scopes are requested.

• Role-based access. All authenticated users within an organization can view activity analytics. Administrative functions (repository tier settings, scoring configuration, user permissions, billing) are restricted to organization admins only.

• Short-lived session tokens. Access tokens are short-lived and automatically expire. Tokens are stored in secure HttpOnly cookies and support revocation via session tracking.

Core application infrastructure runs on AWS in the United States. AI, analytics, billing and other providers also support the Service.

• Core AWS hosting. The application uses AWS U.S. regions, including Ohio. This is not a guarantee of U.S.-only processing by every service provider.

• Encryption at rest. All database storage uses AWS-managed encryption (AES-256) via Aurora's built-in encryption.

• Encryption in transit. All API traffic uses TLS 1.2+ encryption. Database connections use PostgreSQL native SSL/TLS.

• Managed services. We use AWS managed services. AWS's certifications do not constitute a certification of Warclick.

Customers should evaluate the Service against their own regulatory requirements. Warclick does not represent that the Service satisfies every industry-specific requirement.

• Limited collection purpose. We do not clone repositories or use repository file contents for engineering analysis. GitHub responses can include unused file details; author-supplied activity text can contain sensitive information.

• Provider assurances. Infrastructure providers maintain their own security programs. No Warclick SOC 2 or ISO certification is asserted.

• Residency requirements. Customer-specific geographic restrictions require separate feasibility review and agreement.

• Audit-friendly access controls. Role-based access with organization-level isolation, session logging, and failed-access tracking supports internal audit and compliance reporting requirements.

• On-demand documentary reviews. Reasonable security information is available on written request once per twelve months, subject to confidentiality and appropriate redactions. No proactive reporting is required. Custom assessments require separately agreed scope and pricing; legally required assistance remains available.

All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment processor.

• Stripe-managed payments. Credit card numbers and payment details are sent directly to Stripe via Stripe Checkout. Warclick servers never see or store payment card information—not even temporarily.

• PCI DSS compliance. Stripe maintains PCI DSS Level 1 certification, the highest level of compliance. All sensitive payment data is handled entirely on their certified infrastructure.

• Webhook signature verification. All Stripe webhook events are cryptographically verified using Stripe's signature validation before processing, preventing spoofed payment events.

• Subscription metadata only. We store only Stripe customer ID, subscription ID, plan type, and billing status. No card numbers, expiry dates, or CVV codes are ever stored.

• Active accounts. Data is retained for the duration of your subscription plus a reasonable period for service continuity.

• Post-cancellation. After subscription cancellation or GitHub App uninstallation, customer data is retained for up to 120 days for billing reconciliation and to allow for service reactivation. Backup copies expire under the normal backup retention schedule; retained billing, account and legal records are described in our Privacy Policy.

• On-demand deletion. Eligible organization owners can request deletion through the account controls after cancelling an active subscription. We send a completion email after active-data cleanup; backups are not selectively edited and deleted organization data is not returned to active service through restoration.

Warclick will notify affected customers without undue delay and no later than 72 hours after becoming aware of unauthorized access to, acquisition of, or disclosure of Customer Data within systems under our control. Shorter legally required deadlines apply.

• Notification timeline. Affected customers will be notified within 72 hours via email to the organization administrator on file.

• Incident details. Notifications include reasonably known facts about the incident, affected data and corrective measures, with material updates as the investigation progresses.

• Scope. Unsuccessful attempts that do not compromise Customer Data do not trigger the contractual incident notice.

For security-related questions, to report a vulnerability, or to request additional documentation for your security review, please contact:

wlparker+security at gmail.com