Every answer links to its sourceAnswers restate the published trust-centre pages. If this page and a signed order form differ, the order form wins.
Company and assurance
- Who is the supplier?
- Bluebird Technologies Pty Ltd, ABN 57 628 676 764, trading as PatchFlow. Source →
- Is the service generally available?
- With limitsNo. PatchFlow is a founder-led private pilot with operator-supervised launches, suited to non-critical repositories. Source →
- Do you hold SOC 2, ISO 27001 or IRAP?
- Not in placeNo. None is claimed, and the trust centre says so. Source →
- Has an independent penetration test been performed?
- Not in placeNot yet. Customer-specific testing needs a separate written scope. Source →
Access to our code
- How does PatchFlow access repositories?
- Through a GitHub App installed on the repositories you select. Signing in with GitHub identifies a person; it does not grant repository access. Source →
- Can PatchFlow merge or deploy?
- No. PatchFlow opens draft pull requests only and has no merge path. You merge under your own branch protection. Source →
- Can the agent change CI definitions?
- Not by default. CI definitions and GitHub Actions are forbidden agent-edit paths, and changed-file count, retries and concurrency are bounded. Source →
- Does the coding agent need its own access?
- With limitsWith the managed agent, yes: Cursor has a separate GitHub integration that you grant and review separately. With the customer-hosted runner, no: the agent runs in your own GitHub Actions with your repository's token, and PatchFlow never receives your model key. Source →
- Are grants rechecked?
- Yes. Installation and repository grants are rechecked before work and spend. Source →
Data handling
- Where is data stored?
- With limitsThe control plane runs in AWS ap-southeast-2 (Sydney). GitHub, Cursor, npm and CloudFront are global services that may process data outside Australia. Source →
- Is data encrypted?
- Yes, at rest and in transit. Public endpoints use HTTPS. Source →
- Do you store full clones of our repository?
- No. The control plane does not intentionally store full repository clones, CI secrets, or provider API keys entered by customers. Source →
- Is our code used to train models?
- With limitsPatchFlow does not use private repository content to train a PatchFlow foundation model. With the managed agent, review Cursor's terms; with the customer-hosted runner, your own model provider's terms apply. Source →
- How long is data kept?
- Logs 30 days, webhook payloads 90 days, backups 7 days after source deletion; control-plane records deleted within 30 days of a verified request or agreed end. Source →
- Can test output leak secrets?
- With limitsPossibly. Test output excerpts are truncated, not perfectly redacted. Keep secrets out of test logs. Source →
- Is regulated data supported?
- Not in placeNo. Personal, health, payment-card or other regulated data is not authorised for the standard pilot. Source →
Security operations
- How are sessions secured?
- Signed, expiring, Secure, HttpOnly, SameSite cookies. Source →
- Where are provider credentials kept?
- Managed agent: in encrypted secret storage; customers do not enter provider keys. Customer-hosted runner: your model key stays in your GitHub repository secrets and never reaches PatchFlow. Source →
- Can we see a detailed architecture and risk summary?
- Yes. Pilot security reviewers can request it from the security contact. Source →
- Is there an uptime commitment?
- Not in placeNo. The private pilot has no uptime or high-availability commitment; daily automated backups are kept for seven days. Source →
- How do we report a vulnerability?
- Email security@patchflow.run. Pilot security reports are acknowledged within one business day. Source →
Incidents and support
- Will you notify us of a breach?
- Yes, without undue delay after confirming a personal-information breach affecting you, with known impact, containment and remediation. Source →
- What is the support commitment?
- With limitsA one-business-day operator response target during Sydney business days. No 24×7 support or uptime guarantee. Source →
- Is there a DPA?
- Yes. A private-pilot processing schedule can be incorporated into the signed order form. Source →
Your own questionnaire
Send it to security@patchflow.run. Answers come from the same published facts, and anything outside the pilot boundary is stated as out of scope rather than promised.