Data and privacy
What the bot processes and where it is sent.
When you connect the GitHub App, the bot processes pull-request and repository data only for the repositories you select. To produce a result, redacted pull-request content and the repository files the analysis reads are sent to OpenAI through its API. Obvious secrets are removed before transmission, and the analysis does not run for workspaces that have not connected the integration.
SpecMCP stores an audit record of each analysis: repository and pull-request identifiers, commit references, the scope used, the outcome, and a content hash. It does not retain your source code or diffs beyond the processing needed to produce the result.
Source code can contain personal data. Your organization decides what is in its repositories and remains responsible for the lawfulness of that content.
For the full details, including subprocessors and third-country transfer mechanisms, see the privacy policy and the subprocessor list.