Skip to content

Data policy · Private beta

Clear boundaries for your source context.

What Diff Dispatch reads, what it retains, and what is sent to AI providers.

Data policy · private betaRead access · Encrypted credentials · Purged within 24 hours of uninstall

Data we collect

Diff Dispatch reads repository metadata, selected repository contents, commit and pull request history, review activity, organization membership, and reviewers’ GitHub status for repositories an administrator enables. Slack access is limited to user identity mapping, direct messages, and the digest channel you select.

Diff Dispatch keeps a mirror of each enabled repository’s git history, which holds its full source; an index of its pull requests and reviews; reviewer decisions with their evidence and reasons; and operational events. The mirror is how Diff Dispatch sees who wrote each line a pull request changes.

Model processing

A model chooses the reviewers of every pull request that becomes ready for review in an enabled repository. To route it, Diff Dispatch sends our model provider (currently OpenAI) the diff, file paths, the title and description, who wrote and reviewed the changed code and the pull requests behind it, and the eligible reviewers’ review activity and GitHub busy status. Requests to OpenAI use store: false.

Important: our model provider may retain API inputs and outputs for abuse monitoring: OpenAI for up to 30 days unless Zero Data Retention is approved for the relevant account. Diff Dispatch does not claim end-to-end zero retention.

Repository content is treated as untrusted input. The model receives no tools, its answer must fit a strict schema, and code checks that answer before anyone is requested: each reviewer it picks must be someone Diff Dispatch may request, backed by the evidence it was given.

Security

GitHub installation tokens are ephemeral. Slack bot tokens and OAuth credentials are encrypted with AES-GCM using a versioned application secret. Tenant-owned records include an organization identifier and API access is scoped to the authenticated membership.

Deletion and uninstall

Disabling a repository in Diff Dispatch, removing it from the GitHub App, or archiving or deleting it on GitHub deletes its mirror. Uninstalling the GitHub App immediately deletes stored credentials and stops pending processing. Everything else, mirrors included, is purged within 24 hours unless the app is installed again first. Operational records may be retained only where required to investigate security or reliability incidents.

Contact

For privacy questions or deletion requests, email privacy@diffdispatch.com.