Security

Last updated October 18, 2026

Harkai connects to the systems where your team builds and ships, so we design the Services to ask before acting, to request only the access they need, and to keep each customer’s data separate. This page summarizes our current security practices. It is informational and does not create contractual commitments beyond those in our Terms of Service.

Infrastructure

• The Services run on established cloud infrastructure and managed database providers that maintain their own physical, network, and environmental security controls.
• All traffic to and from the Services is encrypted in transit using TLS. Customer data is encrypted at rest by our database and storage providers.
• Production secrets are stored in our hosting providers’ secret management systems and are never committed to source code.

Access to your systems

• Sign-in is handled through OAuth providers such as GitHub and Google. Harkai does not store your passwords.
• Repository access is granted through a GitHub App limited to the repositories you select. It requests repository contents, pull requests, and metadata, and you can revoke it from GitHub at any time.
• On protected branches, Harkai proposes changes through pull requests, so your existing review rules continue to apply.

Human approval by default

• Updates to your product knowledge pause for review and approval before anything is written to your repository.
• Launch posts, emails, videos, and other materials are drafts. The Services do not publish to your channels without your action.

Data isolation and handling

• Customer data is logically separated using row-level security in our database, so each account can access only its own records.
• Hosted product knowledge links are unguessable, excluded from search engine indexing, and every access is logged.
• Before content is sent for AI processing, we remove lock files, build output, and binary files, and we limit payload size. Our AI providers are contractually prohibited from training on customer content, and we do not use customer content to train models.
• When you delete your account, we delete or anonymize your data within a reasonable period, as described in our Privacy Policy.

Application security

• Incoming webhooks are verified with cryptographic signatures and de-duplicated, and events created by bots or by Harkai itself are ignored to prevent loops.
• Inputs and AI outputs are validated against strict schemas before they are stored or acted on.
• We keep dependencies up to date and apply security patches promptly.
• Access to production systems is limited to authorized team members who need it for their role.

Incident response

We monitor the Services for errors and unusual activity. If we become aware of a security incident that affects your data, we will notify you without undue delay and provide information about the incident and the steps we are taking, consistent with applicable law.

Compliance

Harkai is an early-stage company and does not currently hold third-party security certifications such as SOC 2 or ISO 27001. We rely on providers that maintain their own certifications, and we will share more detail about our practices on request.

Reporting a vulnerability

If you believe you have found a security vulnerability, please email us at hello@useharkai.com with a description and steps to reproduce. Please give us reasonable time to investigate and fix the issue before disclosing it, and avoid accessing other customers’ data, degrading the Services, or using social engineering. We will acknowledge your report and keep you informed as we work on it, and we will not pursue legal action against good-faith research that follows these guidelines.