Trust
Last updated
Where your data lives, who processes it, what reaches an AI model, and what Unhandled can read in your repositories. The Security model for AI agents page covers how coding agents connect and what stops them.
1. Hosting
Unhandled runs on Hetzner servers in the European Union. Telemetry, accounts and settings are stored there and travel encrypted. AI provider keys and integration credentials are stored encrypted.
2. Sub-processors
Hetzner Online GmbH (EU): hosting.
Cloudflare, Inc.: edge delivery and email delivery.
AI: none of Unhandled's; customer-chosen provider under customer contract.
The Data Processing Agreement explains how we add sub-processors and how you can object.
3. AI data handling
Unhandled pays for no model and sends nothing to one on its own account. AI summaries and likely causes run only after an admin adds the organization's own Anthropic, OpenAI, Azure OpenAI, Amazon Bedrock or Google Vertex AI account, and the request goes from our servers to that provider under your contract with it. OpenAI and Azure OpenAI requests are sent with storage turned off.
Unhandled is EU-hosted; inference happens in your provider account's region. With Azure OpenAI, Amazon Bedrock or Google Vertex AI you pick that region, and requests go only to that provider's endpoint for it.
Before any text leaves for a model, the organization's AI data policy masks it: secrets only, secrets and personal data, or structure only. The same policy applies to fix prompts, alert investigations, MCP results, tickets and webhooks.
Coding agents you connect over MCP run on your side, with your model and your vendor. Unhandled sends them the results of the tools they call and nothing else.
4. Repository access
By default Unhandled reads no source code. The GitHub App files and syncs issues, and deploys get their commits from the CLI, which sends them from your CI.
Repository read access is an opt-in per installation. When an organization grants it, reads are limited in code to comparing two commits of a deploy (commit SHAs, authors and the first 1,000 characters of each message, at most 50 commits), to one file at a given commit, to the CODEOWNERS file, and to the blame of the single throwing line of an error. There is no tree listing and no code search.
A file is read at a deploy's commit only when an error's stack frame has no source map, or when a connected agent asks for a file under one of the service's code mappings, at most 400 lines at a time. CODEOWNERS is read, and the throwing line blamed, only to name an issue's owner when no ownership rule matches. Each read is recorded in the organization's audit trail with the repository, commit and path, never the content.
Unhandled never writes code, opens pull requests or merges. An agent you run opens the pull request with its own credentials.
5. Single sign-on and provisioning
Organizations can sign members in through their OpenID Connect identity provider and require it. An identity provider can only sign in addresses at a domain the organization proved it owns with a DNS record.
Organizations can add and remove members from their identity provider with SCIM 2.0. Removing someone there takes them out of the organization and revokes their MCP connections, OAuth grants, the agent identities they created and their sessions, in every organization they belong to.
6. Audits and certifications
Unhandled has no third-party audit report yet. When one exists it will be listed here. Until then, the Data Processing Agreement describes the measures we apply and your right to audit them.
7. Contact
Report a security issue or ask for our security questionnaire answers at [legal contact email].