Security and data handling
You are about to give a hosted service a privileged token for your forge. This page says exactly what happens to it.
What the token is used for
Section titled “What the token is used for”The token belongs to a bot account you create, not to you. Gondolier acts as that account:
| Action | Needs |
|---|---|
| Read pull requests and their status | repository read |
Create and delete gondolier/** staging branches |
repository write |
| Post the queue status check | repository write |
| Merge pull requests that pass | repository write |
| Register a webhook | repository admin |
| Configure branch protection | repository admin |
The last two are why repo-admin appears in the setup guide. If you skip them,
everything else still works — you configure the webhook and protection yourself.
Use a dedicated bot account. Not your own. It keeps the audit trail on your forge readable and means revoking access is one action.
How the token is stored
Section titled “How the token is stored”Encrypted at rest with AES-256-GCM before it reaches the database, under a key held as a Cloudflare Secret. Each ciphertext is cryptographically bound to the connection record that holds it, so a value lifted from one connection cannot be decrypted through another.
It is decrypted in memory, for one reconciliation tick, and never persisted in plaintext, never written to a log, and never returned by any API. The dashboard cannot show it back to you — that is deliberate, not an oversight.
Being precise about what this is: a single master key used directly — it is not per-tenant envelope encryption with a KMS-backed wrapping key. External KMS is not a product requirement. A shared-key compromise can expose the credentials protected by that key.
Rotating or revoking
Section titled “Rotating or revoking”Rotate: edit the connection and paste a new token. The replacement is atomic — there is no window in which both work.
Revoke: delete the token on your forge. Gondolier’s copy stops working immediately; nothing else is required of you. Deleting the bot account revokes everything it ever had.
Remove a connection: deleting it in the dashboard removes its stored credential and unmanages every repository under it. Your repositories, branches, and pull requests are untouched.
What we log
Section titled “What we log”Operational metadata: repository names, pull request numbers, batch outcomes, timing, and error messages.
Not logged: your token, your source code, pull request diffs, or file contents. Gondolier never clones your repository — it works entirely through your forge’s API.
Cloudflare records standard request logs for the API. Pull request titles appear in the dashboard activity feed, because they are useful there; if your PR titles are sensitive, that is worth knowing before you enroll.
Where the data lives
Section titled “Where the data lives”- Configuration and credentials — Supabase (PostgreSQL), on infrastructure in the United States.
- Queue execution — Cloudflare Workers and Containers, distributed.
- Your code — stays on your forge. It is never copied to us.
Outbound requests
Section titled “Outbound requests”Gondolier makes requests to the forge URL you supply. URLs naming reserved addresses — loopback, RFC1918, link-local, cloud metadata — are rejected at input, and Cloudflare Workers egress cannot reach private networks in any case. Only HTTPS is accepted.
Getting your data out
Section titled “Getting your data out”GET /api/v1/tenant/export returns everything Gondolier holds about your
tenant — connections, repositories, settings, and audit history — as JSON, with
credentials redacted. It is a normal authenticated call; no request, no waiting.
Deleting your account
Section titled “Deleting your account”Removing every connection removes every stored credential and unmanages every repository. For full account deletion, contact support; we delete tenant records and stored credentials.
Anything Gondolier configured on your forge — the webhook, branch protection — stays until you remove it there. We do not reach into your repository to undo settings during an offboarding, because silently reopening a protected base branch would be worse than leaving a rule you can see.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email the address on gondolier.dev. Please do not open a public issue. We will confirm receipt and keep you updated on the fix.