Security and data.
What Sigma reads from your repositories, what it keeps and for how long, and how to reach us about security. Sigma is in closed beta; this page describes the service as it runs today.
01
What Sigma reads
Sigma reads a repository only through the Sigma Mnemoverse GitHub App, and only where you installed the App and selected the repository in Sigma.
For each review, Sigma copies the repository at the pull request’s head and base commits, so its reviewers can read the diff and the files they need for context. It also reads the pull request’s title and description and the comments addressed to Sigma.
Sigma never pushes to, merges or edits your code.
02
Training
Sigma does not train models on your code. Depending on the selected executor, reviews use Mnemoverse’s API keys, connected Anthropic or OpenAI subscriptions, or both. A hosted review can use the server operator’s subscription even if you have not connected your own. The provider’s terms for the access method used apply.
03
Retention
Sigma’s retention policy is to delete review artifacts, caches and logs 30 days after a review. Automatic deletion is not yet running.
Deletion on request within 7 days: write to [email protected] from the email address you applied with. We confirm the deletion in writing.
Reviews and checks that Sigma has posted stay on GitHub. For what a review keeps, including backups, see What Sigma does with your code.
04
Access and isolation
Installing the Sigma Mnemoverse App grants these repository permissions:
| Permission | Access | What Sigma uses it for |
|---|---|---|
| Contents | Read-only | Fetch the pull request’s commits. |
| Pull requests | Read and write | Read the pull request; post the review, its comments and replies. |
| Checks | Read and write | Publish the Sigma check with the review’s status. |
| Issues | Read and write | Receive /sigma review comments. Write only adds the reaction that acknowledges a request. |
| Metadata | Read-only | Basic repository information, which GitHub grants every App. |
Sigma has no write access to code, so it cannot push commits or merge pull requests.
- For work in a repository, Sigma asks GitHub for a token that covers only that repository of your installation and only the permission the step needs. The token is held in memory and expires within an hour.
- Each review attempt runs in a disposable container that is removed afterwards. The GitHub token stays outside it. On Sigma’s API keys the container has no network access and holds no API key; model calls go through Sigma’s gateway.
- Sigma stores no GitHub password, personal access token or deploy key of yours. Your GitHub sign-in token is kept for your session, at most eight hours, and deleted when you sign out.
05
Reporting a vulnerability
Write to [email protected]. It is the security contact for every Mnemoverse service, and this site’s security.txt names it.
For other questions about your data, write to [email protected].
06
Privacy policy
Section 12 of the Mnemoverse privacy policy covers Sigma: what it processes, where reviews run and who receives data.