GitHub App Privacy Policy

Summary

The app lets GitHub Actions workflows in repositories you choose timestamp and seal their build output as your Sigill organisation, without storing a Sigill key in GitHub. Your files never reach Sigill — workflows send only cryptographic digests (SHA-256, optionally SHA-512). Sigill records which repository, commit and workflow run produced each piece of evidence, taken from GitHub's signed identity token for that run.

What the app can access in GitHub

The app requests two read-only permissions and nothing else:

• Repository metadata (read) — for the repositories you select. Sigill uses it to confirm that a workflow's repository is covered by your installation.
• Organisation members (read) — used once, when you connect, to confirm that the person connecting is an active administrator of the organisation.

The app cannot read your code, issues, pull requests, secrets or any file content, and it cannot change anything in your repositories or organisation. It does not receive webhooks.

What Sigill stores

When you connect (Settings → Apps), Sigill stores the connection:

• the GitHub installation id, account id, account name (e.g. your organisation's login) and account type;
• whether the installation covers all or selected repositories;
• which Sigill user connected it, and when; when it was last used, and when it was disconnected.

To confirm that you administer the organisation, Sigill exchanges a one-time GitHub authorisation code for a GitHub user token, reads your GitHub user and organisation membership, and revokes the token immediately. The token is never stored; your GitHub login is shown on the confirmation page but not stored.

When a workflow issues evidence, Sigill stores, from GitHub's signed identity token for that run:

• repository id and name, repository owner id;
• the git ref (branch or tag), commit SHA, workflow file reference and its commit SHA;
• run id and attempt, the triggering event (push, release, schedule or manual), deployment environment name and runner type;
• the token's unique id (to make each token single-use) and the time of the exchange.

Sigill does not store the GitHub username of the person who triggered the run. The evidence itself — the digest, the timestamp token or seal, and its renewal chain — is stored as for any other evidence in your organisation, as described in the main privacy policy.

What Sigill never receives

• Your files, build artifacts or source code — only their digests.
• GitHub secrets, repository or organisation tokens. The short-lived GitHub identity token a workflow presents is verified and discarded.
• Pull-request content. Runs triggered by pull requests are refused.

Calls Sigill makes to GitHub

Sigill's servers call api.github.com and github.com as the app to check an installation's status and whether it covers a repository (results cached for up to a minute), and — once, when you connect — to exchange the authorisation code, read your user and membership, and revoke the token. Sigill fetches GitHub's public signing keys to verify workflow identity tokens.

Where data is stored, and for how long

Data is stored on the sigill.ai platform in the EU (AWS, Stockholm, eu-north-1); see sub-processors. GitHub is your own provider, not a Sigill sub-processor. The connection is kept until you disconnect it or delete your Sigill organisation. Run provenance is kept as long as the evidence it describes, and is deleted with your organisation. Disconnecting stops new evidence immediately; uninstalling the app in GitHub stops it within a minute.

Legal basis and your rights (GDPR)

The processing is necessary to provide the service your organisation signed up for (Art. 6(1)(b) GDPR). Run provenance contains repository and workflow identifiers rather than personal data; where it does relate to a person, the rights and contact points in the main privacy policy apply. Complaints may be directed to Datatilsynet (the Norwegian Data Protection Authority) or your local supervisory authority.

Changes and contact

Material changes are versioned on this page. Questions and corrections: contact@sigill.ai. Security reports: security@sigill.ai (responsible disclosure).