A tool for proving what happened has to be checkable itself.
What Slipmark Cloud holds, where it lives, who can see it, and how you can check our record without taking our word for it.
Your code stays in GitHub
Files are hashed inside your own CI job. To re-check a run, Slipmark Cloud reads files from GitHub's copy, hashes them in memory and keeps only the hash. File contents are never stored.
UK data location
The database runs in London (AWS eu-west-2, through Supabase) and server code runs in London (Vercel lhr1).
Encrypted
TLS in transit. Encrypted at rest by our database provider. Slack access tokens are also encrypted by us with AES-256-GCM before they're stored.
No API keys to leak
Runs are accepted only with a GitHub-signed token for that repository's own workflow run, so one repository can never write to another's record.
Your GitHub controls apply
Sign-in is through GitHub, so your organisation's GitHub rules apply here too, including required two-factor and SAML single sign-on where you enforce it. Leave the organisation on GitHub and access here goes with it.
Admins checked every time
Rules, overrides, alerts and billing need an organisation admin, checked with GitHub at the moment of the action, including approvals made from Slack.
Append-only, and we can't rewrite it
Every run and every rule change or override is hash-chained. Each day the chain heads are signed and published to Sigstore's public Rekor log, which we don't control.
Verdicts you can attribute
Have your review agent sign each verdict with its GitHub workflow identity through Sigstore. Slipmark Cloud checks every signature itself, so a verdict typed by hand or edited afterwards doesn't count.
Open source where it runs
The gate, CLI and GitHub Action that run in your CI are Apache-2.0, so you can read exactly what runs and what it sends.
Least access we can get away with
The GitHub App reads code, pull requests and who your organisation's admins are, and writes checks. It can't push, merge, change settings or see secrets.
Short sessions
Sign-in lasts 8 hours in an encrypted, HttpOnly cookie, and which repositories you can see is checked with GitHub on each visit.
Keeps working if we don't
The gate decides pass or fail inside your CI on its own. If Slipmark Cloud is unavailable, your pipelines still run; only the hosted record and alerts wait.
Where we stand
Plainly, including what we don't have yet.
| UK GDPR | In place | Registered with the ICO, number ZC192287. Privacy notice. |
| Data processing agreement | In place | Standard DPA, and 30 days' notice before any new sub-processor. |
| Vulnerability reporting | In place | Published policy and security.txt. How to report. |
| Status and uptime | In place | Live checks on the status page. |
| Security questionnaire | On request | We'll complete yours. Send it to us. |
| Our own SOC 2 or ISO 27001 report | Not yet | Not yet available. Slipmark Cloud produces evidence for your SOC 2 and ISO 27001 change-management controls; it isn't itself certified. |
| Independent penetration test | Not yet | Not yet available. |
Documents
Who runs it
Slipmark Cloud is run by Reply Intelligence Group Ltd, registered in England and Wales, company number 17040048, ICO registration ZC192287. For security reviews, procurement or an Enterprise agreement, email hello@replyintelligencegroup.co.uk.