How DocsUpdater handles your access and your data.

GitHub access

Access is granted in two separate steps, and only the second one touches a repository.

1. GitHub sign-in (OAuth). Identifies your DocsUpdater account. We receive your GitHub user ID, login, and — if it is public on your GitHub profile — your email address. Signing in grants no repository access.
2. GitHub App installation. You choose which repositories the DocsUpdater GitHub App may access. Access is limited to the repositories you select and can be changed or revoked at any time from your GitHub settings.

Exact permissions requested

• Repository contents — read-only. Used to read your source code and documentation files.
• Pull requests — read-only. Used to read the pull request under analysis and its changed files.
• Pull request webhook events. Used only to start an automatic run when a pull request is merged, if you enable that.

No write permission is requested for any resource. DocsUpdater cannot commit files, push branches, create or merge pull requests, change settings, or publish documentation, on any repository — including ones you have selected.

Incoming webhook deliveries are verified against the GitHub App’s signing secret before a run is created, so a forged request cannot queue work on your account.

Access to your application

To capture screenshots, the agent opens the URL you configure for the project in a sandboxed browser and navigates it like a visitor would. We recommend pointing DocsUpdater at a staging or preview environment, with a dedicated, least-privileged test account.

If a project has a test-account password, it is encrypted at rest with AES-256-GCM under a key held only by the application server. It is never written into the instructions the agent receives, never returned to the browser, and never shown again after you save it. At the moment the browser needs it, it is decrypted and typed directly into the password field.

Results and storage

• What a run stores. The pull request reference, the generated Markdown draft, the documentation-impact and pull-request-summary reports, the screenshots captured during the run, and a trace of the steps the agent took.
• Who can read it. Drafts, reports, and screenshots are served only to the authenticated account that owns the run. There are no public or shareable result links.
• Nothing is published. A result is a private draft until you copy it somewhere yourself.
• Retention. Runs and their artifacts are kept for as long as your account exists, so that you can go back to earlier results. There is no automatic deletion, and there is no self-serve delete yet.
• Deletion on request. Email support@docsupdater.com and we will delete a project’s history, or your account and everything belonging to it. We will confirm when it is done.

Infrastructure and payments

• All traffic to docsupdater.com is served over TLS.
• The application, its database, and run artifacts run on infrastructure we operate directly, rather than being distributed across third-party storage services.
• Payments are handled by Stripe. Card details are entered on Stripe’s pages and are never sent to or stored by DocsUpdater; we keep only the Stripe customer and subscription identifiers needed to apply your plan.
• We use PostHog for page-level product analytics. Automatic click capture and session recording are disabled.

Reporting a problem

If you believe you have found a vulnerability, email support@docsupdater.com with enough detail to reproduce it. We will acknowledge your report and keep you updated while we work on a fix. Please do not test against other users’ accounts or data.

See also: Privacy · Terms