# Security and trust

How code and accounts are stored, who can reach them, and how to report a problem.

## Where things live

- **Code** is stored in Git on Cloudflare: Cloudflare Artifacts, or our own Git storage on Cloudflare R2. Each project's code is separate from every other project's.
- **Accounts** are in a Cloudflare D1 database: your GitHub login, name, picture and email, your teams, and your sessions. GitHub access tokens are encrypted before they are stored, and are only read on the server.
- **History, merge records and audit events** are kept per project and per team.

## Who can reach what

- Projects belong to teams. Owners and admins run a team; members see the projects their team gives them.
- Tokens are scoped: an admin token for a project, a workspace token that writes only its own workspace, and agent group tokens that hand each agent its own workspace. Checks and sandboxes never hold a credential.
- A signed-in session works only from Switchyard's own pages. Changes made with a session must come from those pages.

## Sign-in

- Sign-in is with GitHub. During the private beta only approved accounts can sign up.
- Sessions are signed with a key the database does not hold, so a copy of the database alone signs nobody in. Session cookies are Secure, HttpOnly and SameSite=Lax.
- Your account page lists where you are signed in. You can sign out one place, or everywhere, including `yard` in terminals.
- You can delete your account from the account page. You leave every team; a team only you are in, with no projects, is deleted with you. If you are the only owner of a team others are in, or of one that owns projects, hand it over first.

## Evidence

- Every sensitive action is in your team's audit log for 400 days, and can be exported.
- Every merge has a merge record of what merged, why it was allowed, and which checks passed. Commits are signed on each agent's behalf.

## Who processes your data

| Company | For |
|---|---|
| Cloudflare | Hosting, code storage, databases and email |
| GitHub | Sign-in, and the repositories you choose to connect |

## Reporting a problem

If you find a security problem, please tell us privately before telling anyone else, and give us a reasonable time to fix it. Write to security@switch-yard.dev.