Security
Read-only, tenant-scoped, and specific about it.
This page is written to be handed to whoever runs your security review. It says what Pacia reads, what it deliberately does not, how credentials are stored and how tenant isolation is enforced — in enough detail to be checked rather than taken on faith.
What Pacia reads
Pull request metadata
Titles, authors, reviewers, timings, sizes, check results and merge state. Not file contents — Pacia does not read or analyse your source code.
Repository metadata
Names, default branches and organisation membership, the last of which is used to map people to teams.
Issue tracker data
Where Jira is connected: issues, sprints, epics, changelogs, links, statuses and resolutions. Read-only — Pacia never writes to Jira.
AI provider organisation analytics
Aggregate seat, usage and where available cost figures from GitHub Copilot, Cursor and Anthropic. Never prompts, completions or generated code.
How access and credentials are handled
Read-only scopes only
GitHub: Pull requests (read), Metadata (read), Members (read). GitLab: read_api. Azure DevOps: Code (Read). Jira: a read-only API token. Nothing writable is ever requested.
AES-256-GCM at rest
Every access token lives encrypted in a dedicated credentials table under a separate encryption key, and is never included in any API response.
Provider keys entered in one place
AI provider keys go into the provider password field in the product. They should never travel by email or chat, and the interface says so.
The GitHub App is repo-scoped
It is installed on the specific repositories you choose. A team lead can connect their own repositories without organisation-owner approval, and the install can be limited as narrowly as you like.
Tenant isolation and access control
Every table is organisation-scoped
Organisation scoping is applied at the query level rather than in the interface. Project keys are not assumed unique across tenants — one customer’s configuration can never influence another’s figures.
Roles read live from the database
Owner, admin and member, re-read per request rather than trusted from a session token, so a revoked role takes effect immediately rather than at next sign-in.
Members are restricted to their own teams
Team-level access restriction is threaded through the query services, not applied as a display filter.
MFA, including on the API surface
Where MFA is required it is enforced at sign-in, and the MCP endpoint — which has no interactive channel for a challenge — satisfies it at token issuance and then re-checks active status, organisation membership and the MFA requirement live on every single request.
One revocation path
Personal MCP tokens and OAuth grants both end as one row in one table, so revoking access has a single implementation rather than two that can drift apart.
Security review questions
Does Pacia read our source code?
No. It reads pull request metadata — who, when, how long, how large, which checks — not the contents of files. Nothing in the analytics requires reading code, so nothing requests it.
Can Pacia write to our repositories or Jira?
No. Every integration is read-only. No scope requested by any provider connection permits a write, and the Jira integration never posts, transitions or edits anything.
Where is data hosted?
Pacia is operated as a multi-tenant service on infrastructure we manage. If your review needs specifics on region, sub-processors or retention beyond the 24-month history window, ask on a call and we will answer directly rather than pointing at a marketing page.
What happens when we disconnect a provider?
The stored credential is removed and syncing stops. Data already collected remains subject to your retention arrangement; if you want it deleted, that is a request we action rather than a setting buried in an admin screen.
How do you handle the MCP endpoint securely?
The organisation is resolved from the caller’s token and is never a tool argument, because a language model will invent a plausible organisation identifier if given the chance. Active status, membership and the MFA requirement are re-read from the database on every request rather than trusted from issuance.
Questions your security team needs answered
We would rather answer specifics on a call than publish a page of assurances. Send the questionnaire.