Security & data handling
Symvanta is graph-first by design. We parse your repositories into a knowledge graph and, by default, discard the source. This page explains exactly how that pipeline works, what we encrypt, where we run, the permissions we request, and how we handle incidents. No marketing, just the mechanics.
Every repository you connect flows through the same four steps. The output that we keep is the graph: symbols and the relationships between them. Your raw files are not part of it.
Stored source is an optional, paid add-on. It is never on unless you explicitly turn it on. When you do, Symvanta retains your indexed checkout in that same in-memory store, isolated to your workspace, so raw-file tools (read_file, grep, tree) work for CI, chat, and headless agents. It is never copied to a persistent disk, and turning the add-on off stops those tools from serving it. Even with it on, your code is never shared across tenants and never used to train models.
When an agent makes uncommitted edits queryable with index_working_tree, those file contents are indexed into a short-lived revision that is reclaimed within a few hours and scoped to your workspace.
Every connection is encrypted with TLS 1.2 or higher: your browser to the app, your agent to the MCP endpoint, our services to GitHub, and our internal service-to-service traffic.
Sensitive secrets (OAuth client secrets, per-tenant GitHub credentials, and 2FA recovery codes) are encrypted with AES-256-GCM before they are written to the database. The encryption key lives in the runtime environment, never in the database alongside the data it protects, so a database read on its own does not expose those secrets.
Symvanta runs on Hetzner in Germany, so your data is processed and stored in the EU. The platform is built from a small, well-understood set of datastores:
None of these datastores is reachable from the public internet. They sit on a private network behind a firewall that only admits the application tier, so the graph and embeddings cannot be queried directly from outside.
We request the minimum each integration needs, and you can see the full list before you approve it.
You connect Symvanta through a GitHub App, installed only on the repositories you choose. The App requests:
Per-tenant GitHub credentials are encrypted at rest. The optional automated-fix add-on, only when you enable it, additionally requests permission to open pull requests; it raises draft pull requests for your review and never pushes commits to your branches on its own. GitHub shows you the exact permission list on the installation screen before you approve, and you can revoke access at any time from your GitHub settings.
If you sign in with Google we request only the openid, profile, and email scopes, used solely to create and authenticate your account. We never access your Google Drive, Gmail, Calendar, or Contacts. See our Privacy Policy for the full detail on Google user data.
mcp:read), not your GitHub credentials.Production is monitored continuously with metrics and error tracking, so anomalies surface quickly. If you believe you have found a vulnerability, email info@symvanta.com with the details and we will work the report promptly. Please give us a reasonable window to remediate before any public disclosure.
If an incident affects your data, we will investigate, contain it, and notify affected customers without undue delay, consistent with applicable law.
Disconnect a repository and its graph is removed. Request account deletion by emailing info@symvanta.com and we remove your data within 30 days. For self-hosted requirements, an on-premise deployment keeps the entire pipeline inside your own infrastructure.
We are happy to walk through architecture, data flows, and access controls in detail.