Security and data handling

Access

• We ask for the least access the work needs: usually the right to open pull requests in your repository, access to your CI, a test environment and test accounts.
• Every change goes through a pull request, and a person reviews it before it is merged.
• You can remove our access at any time, without asking us first.

Secrets and credentials

• Credentials live in your vault or your CI secrets. They are never written into test code, reports or chat messages.
• Tests use test accounts made for the work, not the accounts of your staff or your customers.

Test environments and personal data

• We test against staging or preview environments with test data, not against production.
• Please keep real customer data out of the environments we test, and above all data that needs special care, such as payment card numbers, location history or health data.
• If the work has to touch personal data, we sign a data processing agreement with you before we receive any, and we process it only on your written instructions.

What the AI model sees

The agents are built with the Claude Agent SDK and run on Claude, through the Anthropic API under Anthropic's Commercial Terms. They read only what a task needs: code, specs, tickets and test results.

• The Commercial Terms say Anthropic may not train models on customer content (see also Is my data used for model training?).
• Anthropic's Privacy Center says API inputs and outputs are deleted within 30 days by default, and that content flagged under its usage policy can be kept for up to 2 years (How long do you store my organization's data?).
• Zero data retention is available from Anthropic only by agreement. Unless we confirm in writing that such an agreement covers your work, the standard retention above applies.

Anthropic's terms and policies as read on October 18, 2026. They can change; the links go to the current versions.

Confidentiality

We sign an NDA on request, before you share anything confidential. Your code, plans and reports are used only for your work.

Vendors that process data for us

These certifications belong to the vendors and cover their own services, not Releaseworthy. Each vendor shares its full reports with its own customers. Vendor pages as read on October 18, 2026.

Your own tools, such as your repository host, CI, issue tracker and device cloud, stay on your accounts and under your contracts with them.

Security incidents

If we learn of a security incident that affects your data, we tell you without undue delay, with what we know, what we have done and what we need from you.

When the work ends

You remove our access. We delete the copies of your code and data that we hold, and confirm it in writing if you ask. The tests, plans and reports already live in your repository, so there is nothing to hand back.

Certifications and security reviews

We do not hold a SOC 2 report or an ISO 27001 certificate. We keep written security policies, a risk register and a Statement of Applicability against the 93 controls of ISO/IEC 27001:2022 Annex A, and our answers to the Cloud Security Alliance CAIQ v4.1 questionnaire. None of this is a certification or an audit report. The documents are available under NDA.

If your security review has a questionnaire, send it to qa@releaseworthy.app and we answer it plainly, including where the answer is no.

The law that applies

We are a company in Vietnam. Our handling of personal data falls under Vietnam's Law on Personal Data Protection (Law No. 91/2025/QH15) and Decree No. 356/2025/ND-CP. If your data also falls under the GDPR or another law, tell us before the work starts, so the agreement covers it.

Report a security issue

Found a security issue on this website or in our open-source project? Email qa@releaseworthy.app with the subject Security report. Please do not access data that is not yours, and give us reasonable time to fix the issue before you share the details. We do not run a paid bug bounty.

The same contact, in the standard machine readable form: security.txt.