Last updated: April 16, 2026

Security

Security is not a feature of Akira — it is a condition for the product to exist. When you connect Akira to your repository, you are giving us access to your company's most sensitive asset: the source code. We take this seriously.

This page describes the guarantees and practices we adopt. We do not claim to be "100% secure" — no system is. We work with defense in depth, data minimization, and the principle of least privilege to continuously reduce the attack surface.

For formal audits, due diligence, or specific questions about our security program, contact our team through the dedicated channel: seguranca@blueaisolutions.com.br.

1. Architecture and isolation

Isolated environments, restricted access, and clear separation between different customers' data.

• Per-customer isolation: each customer accesses only their own data, enforced across multiple layers of the application. Even if one layer fails, isolation remains in effect.
• Separate environments for production, staging, and development, with distinct credentials. Real customer data exists only in production.
• Access to production restricted to a small number of authorized engineers, with individual credentials and an audit trail.
• Isolated asynchronous processing from public routes — failures in analysis tasks do not affect the overall stability of the service.

2. Encryption

Data protected in transit and at rest, using industry-standard algorithms.

In transit:

• TLS 1.2+ on all external connections. HTTP is redirected to HTTPS.
• HSTS enabled on public domains.
• Webhooks validated by cryptographic signature before any processing.

At rest:

• Database with disk encryption (AES-256).
• User passwords are not stored by Akira — authentication is delegated to our identity provider, which applies secure hashing.
• Access tokens for external services are stored encrypted, with immediate rotation when access is revoked by the customer.

3. Authentication and access control

You log into Akira through GitHub. All internal access follows the principle of least privilege.

• Login via GitHub OAuth — we never store user passwords.
• GitHub App with minimal permissions: read access to Pull Requests and write access limited to comments. We do not request access to secrets, Actions, billing, or repository administration.
• MFA recommended through your GitHub account — we strongly encourage enabling it.
• Internal admin panel isolated from customer-facing interfaces, with additional authentication and specific access controls.
• Immediate revocation: uninstalling the GitHub App cuts off all of Akira's access instantly.

4. How we handle your code

This is the most important part — so let's be direct.

We never train AI models with your code. Neither ours, nor our vendors'. The AI providers we use (Google Gemini and Anthropic Claude) have contractual clauses that prohibit the use of enterprise API data for training — and we confirmed this before choosing them.

We do not store the content of your files. Akira reads the diff of your Pull Request, generates an analysis, posts the comment, and discards the content. Only review metadata is retained: PR identifier, date, status, and the published comment. The code itself is not stored.

We only send the diff, never the full repository. We do not send commit history, files outside the diff, credentials, or environment variables. Only the context strictly necessary to generate the review is sent.

No BlueAI human reads your code by default. The flow is fully automated end to end. If something goes wrong and you open a ticket requesting an investigation, we will request explicit permission to analyze a specific PR — and this is logged.

Deletion at any time. Uninstalling the GitHub App stops access. Deleting your account removes review metadata within 30 days.

5. Secrets management

Keys, tokens, and credentials are never kept in plain text in repositories or servers.

• Centralized vault for secrets, with runtime injection and individual access control.
• Separation by environment (production, staging, development) with distinct credentials. A secret compromised in staging does not affect production.
• Rotation supported for all critical credentials, with immediate revocation in case of suspected compromise.
• Continuous scanning against accidental credential leakage in code.
• No secret travels through the frontend — integrations with external services occur exclusively through the backend layer, under authentication.

6. Protection against vulnerabilities

We write code with the same paranoia we expect from our customers.

• Parameterized queries throughout the data layer — eliminating the SQL Injection vulnerability class by construction.
• Strict input validation on all endpoints before any business logic.
• Strong typing and payload validation throughout the frontend.
• Security headers (HSTS, CSP, X-Frame-Options, Content-Type) applied to public pages.
• CSRF protection on mutating routes. Session cookies marked as HttpOnly and Secure.
• No arbitrary code execution. Akira analyzes text — it never runs your code.
• Monitored dependencies, continuously checked against known vulnerabilities, with priority patching.
• Mandatory code review: every internal PR goes through Akira itself and a human review before merging.

7. Monitoring and logs

We log enough to investigate incidents, without turning into a dossier about you.

• Structured logs with a unique identifier per request, for end-to-end traceability.
• Metrics for latency, errors, and volume per endpoint, with internal dashboards.
• Automated alerts for critical failures and anomalous behavior.
• Limited retention: operational logs discarded after 30 days. Audit logs for access to sensitive data kept for 12 months.
• Logs do not record the content of your code, diffs, or tokens — only operational metadata (identifiers, timestamps, status).

8. Payments

BlueAI never sees your card number.

• Stripe as our exclusive processor, PCI-DSS Level 1 certified — the industry's highest standard.
• Checkout hosted by Stripe: the page that collects the card is Stripe's, not ours.
• Card data never travels through our infrastructure and is never stored. We only receive opaque references and subscription identifiers.
• Webhooks validated by cryptographic signature, with idempotent handling to prevent duplication.

9. Backup and recovery

If something breaks, we come back online. And we test this.

• Automated backups of the database with Point-in-Time Recovery (PITR) of up to 7 days.
• Reproducible infrastructure for rapid re-provisioning in case of environment loss.
• RTO of up to 4 hours for complete restoration in the event of losing the main environment.
• RPO of up to 1 hour in a worst-case scenario.
• Automatic retry and a failure queue for tasks that don't complete on the first attempt — with no silent loss of processing.
• Restore tests performed periodically in an isolated environment.

10. Compliance (LGPD and Marco Civil)

We operate in compliance with Brazilian data protection and internet legislation.

BlueAI Akira is developed in compliance with the LGPD (Lei nº 13.709/2018) and the Marco Civil da Internet (Lei nº 12.965/2014). We collect only the data strictly necessary for the operation of the service, under documented legal bases (contract performance, legitimate interest, consent, and legal obligation).

• Privacy Policy and Terms of Use publicly available, detailing legal bases and subprocessors.
• Data minimization: we do not collect what we do not need.
• Data subject rights (access, correction, deletion, portability, revocation) handled through a dedicated channel, with a response within 15 days.
• Data Protection Officer (DPO): contato.akira@blueaisolutions.com.br.

Full details on data processing and subprocessors are available in our Privacy Policy.

11. Incident response

If something goes wrong, we tell you. Fast, and without beating around the bush.

We have an internal incident response process that covers detection, containment, eradication, recovery, and communication. In the event of a security incident with impact on users, we follow Art. 48 da LGPD: we notify the ANPD and the affected data subjects within a reasonable period, disclosing the nature of the incident, the data involved, the risks, and the measures taken.

• Severity classification and runbooks defined for the most likely scenarios.
• Immediate rotation of credentials suspected of being compromised.
• Notification to affected customers within 72 hours of confirmation, by email, describing what happened and the actions taken.
• Post-mortem after relevant incidents, with traceable corrective actions.

12. Vulnerability reporting (responsible disclosure)

Found a security bug in Akira? We want to know before anyone with bad intentions does.

Official channel: seguranca@blueaisolutions.com.br (PGP available upon request).

How to report:

• Describe the vulnerability with technical details (endpoint, payload, reproduction steps, estimated impact).
• Include versions, dates, and screenshots or logs when applicable.
• If possible, propose a mitigation.

Our commitment:

• Acknowledge receipt within 2 business days.
• Provide an initial assessment and remediation plan within 10 business days.
• Keep you updated on the progress of the fix.
• Give public credit (with your permission) in our Hall of Thanks.
• Not take legal action against good-faith research that follows this process.

We ask that you:

• Do not exploit the vulnerability beyond the minimum necessary to demonstrate it.
• Do not access, modify, or delete other users' data.
• Do not carry out denial-of-service attacks, social engineering against our team, or tests that degrade the service.
• Allow a reasonable amount of time for a fix before public disclosure (90-day standard embargo, negotiable).

Monetary rewards for critical vulnerabilities are evaluated on a case-by-case basis. We do not yet have a formal bug bounty program, but we recognize serious work.