Security practices
Last updated Jun 11, 2026
Logorythm reads your repositories to draw the real architecture of your system. We treat your code as the most sensitive asset there is. This page describes the technical and organizational measures we take to protect it.
1. Ephemeral code processing.
Your source code is analyzed in memory during the scan and discarded when processing completes. We do not keep a copy of your files in a database, backup, or application log.
What persists is only the analysis result: the service graph, communication edges, metrics, and derived metadata. That graph cannot be used to reconstruct your code.
2. Authentication and session.
Access is provided through GitHub OAuth and GitHub App installation. We do not create passwords or request credentials of our own in any flow.
The session lives in an HttpOnly cookie (__Host-logorythm_session), unreadable by browser JavaScript. We do not store tokens, emails, or workspace identifiers in localStorage or sessionStorage.
3. Least-privilege GitHub App access.
The GitHub App requests only the permissions it needs and runs only on repositories you choose to install it on. You grant and revoke that access directly on GitHub at any time.
Repository access is read-only. Logorythm never opens a pull request, never pushes, and never changes your code.
4. Encryption in transit and at rest.
All traffic between you, GitHub, and our API uses TLS. There is no plaintext endpoint.
Graph and account data we persist are encrypted at rest on our cloud providers' infrastructure.
5. Infrastructure and isolation.
We operate on established cloud providers for edge, compute, and object storage. The list of subprocessors is in the Privacy policy.
Every workspace is logically isolated. One customer's scan never crosses into another customer's data.
6. Audit logging.
Sensitive actions, such as starting a scan, granting access, or deleting data, are recorded in an audit log for traceability and incident investigation.
7. Responsible disclosure.
If you identify a vulnerability, write to contato@logorythm.com.br with enough detail to reproduce it. We investigate every good-faith report and will not pursue legal action against responsible security research.