Built to be trusted with your code.
Versyka changes code, so trust is the product. Here's what it can access, where your code runs, and what we keep.
- Pull requests only. Versyka never pushes to your default branch, and nothing merges without your review.
- Only the repositories you choose. The GitHub App sees only the repositories you select. Uninstall it to stop all access.
- A throwaway sandbox for each job. Your code is built and tested there with a read-only token for one repository, then the sandbox is destroyed.
- Encrypted. TLS in transit, encrypted at rest (GitLab tokens with AES-256-GCM).
What we keep, and what we never keep
What we keep
- Your repository list. The name, ID and default branch of each repository you connect, and which ones your plan covers.
- What the scan finds. Package names and versions, and the file paths and line numbers where something needs fixing.
- Migration records. Status, pull request links and check results. Build and test output is deleted after 30 days.
What we never keep
- Your source code. It's read in memory or in a throwaway sandbox for each job, then gone. For a migration, only the affected files go to Anthropic's Claude API to write the edit.
- GitHub access tokens. They are requested per job, expire within about an hour and are never stored.
- AI training on your code. Your code is never used to train any model, ours or anyone else's.
Uninstall the GitHub App and your account and these records are deleted right away.
For a security review
What the GitHub App can do
Only on the repositories you select. It can't change your account or organization settings.
| Permission | Access | Why |
|---|---|---|
| Repository contents | Read and write | Read manifests and code, and create the branch for a pull request |
| Pull requests | Read and write | Open pull requests and reply to @versyka commands on them |
| Checks | Read | Show whether your CI passed on Versyka's pull request |
| Commit statuses | Read | The same, for CI systems that report statuses instead of checks |
| Issues | Read | Receive @versyka commands (GitHub delivers pull request comments only with this permission) |
| Metadata | Read | List the repositories you selected, with their names and default branches |
| Email addresses | Read | Sign you in to the dashboard, nothing else |
Service providers
Each processes data only to provide its service. We don't sell or share your data with anyone else. Repository content passes only through the first group, and your code is never used to train AI models: Anthropic doesn't train on Claude API data under its commercial terms.
Handle repository content
Only as needed to run a scan or a migration.
- GitHubRepository access and pull requests, via the GitHub App you install
- GitLabRepository access and merge requests, if you connect GitLab
- Anthropic (Claude API)Writing migration rules and code edits, from the files being changed
- E2BIsolated sandboxes where code is cloned, built and tested
- Trigger.devRunning scans and migration jobs
Run accounts, billing and the website
Accounts, payments, email, analytics and uptime.
- SupabaseDatabase for accounts, repository lists and migration status
- VercelHosting this website and dashboard; web analytics
- StripePayments (we never see full card numbers)
- ResendTransactional email
- PostHogProduct analytics on our website
- SentryError monitoring
- CloudflareDNS and email routing
- SlackAlerts posted to your channel, if you connect it
- Better StackStatus page and uptime checks
Company and compliance
- Legal entity
- Karthik Mulugu, doing business as Versyka, a sole proprietorship based in Michigan, United States.
- Security contact
- karthik@versyka.com · +1 (616) 522-2677. Reports go straight to the founder.
- Data location
- Our database (accounts, repository lists, scan findings and migration records) is in the United States, on AWS US East through Supabase. Your source code isn't stored anywhere.
- Access to your data
- We look at your account's records only to run the service, fix a problem you report, or meet a legal requirement. Never for marketing, unless you ask us to.
- Billing
- Card payments through Stripe, or pay by invoice on the Scale plan.
- Last reviewed
- October 27, 2026
- SOC 2
- Planned
- Not yet. We plan to begin as Versyka moves from pilots to paid plans.
- Penetration test
- Planned
- Not yet performed by an outside firm.
- Source code security review
- Done
- October 2026. Every issue it found was fixed and is covered by regression tests.
- Security questionnaires
- Open
- Send yours and we'll answer it directly.
Found a security issue? Email karthik@versyka.com. Please give us a reasonable chance to fix it before disclosing it.