Security and privacy
PatchWave reads your code to analyze and fix dependency updates. This page explains where that code goes and what we keep.
AI models
Section titled “AI models”PatchWave runs its models on Amazon Bedrock with zero data retention. Bedrock doesn’t store prompts or your code, and doesn’t train models on them.
Where your code runs
Section titled “Where your code runs”- Each analysis or fix runs in its own isolated, short-lived microVM with no inbound network access.
- PatchWave clones the pull request and deletes the clone when the run ends. We don’t keep a copy of your repository.
What we store
Section titled “What we store”- Reports: verdicts, evidence, and fix plans. Evidence can quote short excerpts of your code.
- Pull request context, such as CI logs. We delete it after 30 days.
- PatchWave uses short-lived GitHub app tokens and doesn’t save them. When you connect your GitHub account, we store your user token encrypted, and only the PatchWave web app can decrypt it. PatchWave uses it to approve pull requests on GitHub when you approve them in PatchWave.
Secrets you add
Section titled “Secrets you add”See Integrations to connect the tools your team uses to PatchWave.
Tokens you add in Settings → Secrets are encrypted in AWS Systems Manager Parameter Store. You can’t view them after saving, and only workspace admins can manage them.
When PatchWave reviews or fixes an update, it passes these secrets to your package manager and build as environment variables. Use least-privilege tokens.
Access and merge controls
Section titled “Access and merge controls”- PatchWave only acts on repositories you activate.
- Nothing merges unless your auto-merge policy allows it, and PatchWave never merges a change it wrote.
- Workspace membership follows your GitHub organization. People who leave the organization lose access.
Stuck? Email support@contextbridge.ai and a human will help.