What Proof stores about your code

What a sealed record contains

When you sign off a change, Proof stores one record. Here is everything in it:

• The path of each changed file, and whether it was added, modified or deleted.
• What you decided about each file, and whether you actually opened it.
• Counts: files total, cleared, approved, approved without opening, flagged, and lines added and removed.
• Anything you wrote yourself: your note on a file, your reason for flagging it, and your own description of what the change does.
• Which repository, pull request and commit SHA the review was performed against.
• Who signed it, when, and what role they held at that moment.

What it does not contain

No source code, no diffs, no file contents. Proof reads your diff to show it to you while you review, and what it keeps afterwards is the verdict, not the material.

Two honest caveats, because a trust page that only reassures is not worth reading:

• File paths are stored, and paths describe how a project is built. If your directory names are sensitive, treat the record as sensitive.
• Your own notes are free text. If you paste a snippet into a note, that snippet is in the record, because you put it there.

Why records are hard to quietly edit

Each record is hashed with SHA-256 over a canonical form of its contents, and each hash is chained to the one before it. Changing a record after the fact breaks every link that follows, so a rewrite is visible rather than silent.

A record also keeps its own copy of what it signed. Deleting the project does not erase the evidence that a review happened.

Who else processes your data

These are the services Proof actually calls. Not a list of everyone we have an account with.

• Supabase: the database and sign-in.
• Cloudflare: hosting and access control.
• Stripe: billing. Card numbers never reach us.
• Resend: transactional email.
• PostHog (US): product analytics, with an opt-out you can use.
• GitHub: the Proof app, for reading pull requests and posting the check.
• Anthropic and OpenAI: model calls.

How long it is kept

Deleting your account or workspace removes your data, and backups roll off within 30 days.

Sign-off records and the audit log are the exception: they are kept, on purpose. Evidence that expires is not evidence, and a record that vanishes when someone leaves cannot answer who was answerable. If you need a specific record gone, ask and we will remove it.

Questions this page does not answer

Ask us. A vague answer here would be worth less than a real one from a person. Use the contact form on the home page. The privacy policy covers the legal side.