Security and data

Ernest needs enough access to inspect pull requests, but the product should keep repository execution, billing state, and user data separated.

GitHub access

The GitHub App installation controls repository access. Ernest only sees repositories included in the installation.

Inside Ernest, each synced repository has its own activation switch. Disabling a repository in Ernest stops hosted inspections for that repository without changing the GitHub App installation.

Data Ernest stores

Ernest stores account, organization, installation, repository, subscription, and usage records needed to operate the product.

For review output, Ernest stores enough inspection metadata to track status, quota, and customer history. The product should avoid storing more source code than needed for inspection and support deletion of an organization record when requested.

Sandbox isolation

Hosted inspections run outside the product control plane. Repository execution belongs in the runner and sandbox plane, not in the web or webhook service.

This separation keeps customer code execution away from billing, authentication, and dashboard state.

Deleting an organization

Organization deletion removes the Ernest organization record and cascades dependent Ernest records such as memberships, synced repositories, GitHub installations, and subscriptions.

Deleting an organization from Ernest does not uninstall the GitHub App in GitHub and does not cancel billing with the provider. Handle those external systems separately until the dashboard exposes a full self-serve flow.

Enterprise controls

Enterprise plans can support stricter data-handling needs such as custom retention, deletion policy, security review, SSO/SAML, SCIM, audit logs, and dedicated support.