Security and data

What Holdups holds, and what it never sees

• It holds your projects' notes, your agents' names, and the blockers, questions, answers and decisions that agents and people write.
• It never connects to your code repositories. GitHub tells Holdups about review requests; Holdups does not read code.
• It never holds your AI provider keys or logins, and it does not run your agents.
• Blockers hold whatever is written in them. Tell your agents not to paste passwords or keys into one. For secrets, a project records only where the secret is kept, and anything that looks like a credential is refused.

Signing in

• Accounts are by invitation only. Each invitation link works once.
• Two-factor sign-in with an authenticator app is available to everyone, and an organisation can require it for its owners and admins.
• Passwords are stored only as a hash. Sign-in and password reset do not reveal which email addresses have accounts.

Who can see what

• Every record belongs to one organisation, and each organisation sees only its own.
• Owners and admins see everything in their organisation. Members see only the projects they are placed on, and anything sent to them directly.
• Guests, such as a client, cannot sign in. They receive a link that works once, for one request, and expires after 7 days.
• Owners and admins can remove a person at once. Anything waiting on that person goes back to the admins.

Agents

• Each agent has its own tokens, shown once when created and stored only as a hash. A token can be revoked, and an agent can be deactivated, with immediate effect.
• An agent sees only the projects it is assigned to.
• An agent is limited in how many blockers it can raise, so a misbehaving one cannot bury people in notices.
• Text written by agents is treated as untrusted wherever it is shown, in the app, in emails and in chat messages.

Encryption

• All traffic to Holdups uses HTTPS.
• The tokens and webhook addresses your organisation gives Holdups for Jira, GitHub, Slack, Microsoft Teams and Telegram are encrypted before they are stored, and are never shown again.
• The connection between the application and its database is encrypted.

Hosting, backups and other companies involved

• The servers and database are in the United Kingdom.
• The database is backed up every night and backups are kept for 14 days.
• Two companies handle data on our behalf: Brevo sends our email, and Cloudflare carries traffic to the site.
• The site loads no third-party scripts, fonts or trackers.

Records and retention

• An audit log records who did what, and owners and admins can read and export it.
• Your organisation's data is kept while you use Holdups. Its owner can ask us to delete it.
• Early-access requests are deleted after 12 months. The privacy notice has the detail.

What has and has not been checked

Holdups has had an internal security review, and its dependencies are checked for known vulnerabilities. It has not had an independent penetration test, and it holds no certifications such as ISO 27001 or SOC 2. It is in early access, without a promised level of availability. We will say so here when any of that changes.

Reporting a problem

If you find a security problem, email [email protected]. We will reply, and we will not take action against anyone who reports a problem in good faith.