We're in closed beta. Sign up for early access — founding pricing locks in at signup.Sign up for early access
Security
Time-based one-time codes (TOTP) as an extra login factor, independent of your password.
Your identity provider stays the source of truth for who can log in. Configure SAML or OIDC SSO yourself from your organization settings.
SCIM 2.0 user and group provisioning — create, update, deactivate users, and map groups to roles. Generate your SCIM token from your organization settings and connect your IdP yourself.
See every active session tied to your account and sign out of all of them remotely in one action. Revoked sessions are deny-listed and rejected, not left valid until they happen to expire.
SSO, SCIM, membership, and repository-governance changes are all written to your org’s audit log, with an export endpoint and an optional webhook to your own SIEM.
Owner, Admin, Manager, Member, Billing Admin, and Auditor roles, each scoped to a fine-grained permission set. Auditor is read-only — access to the audit log and organization data, without the ability to change anything.
Required approvals, CODEOWNERS enforcement, stale-approval dismissal, and required status checks gate the merge button per repository — configurable, not just documented.
Set merge and push-protection rules once and apply them across every targeted repository at once — targeted by visibility, an explicit repo list, or a name pattern — instead of configuring each repository by hand. Rulesets compose with a repository’s own settings on a strictest-wins basis. An admin can bypass a blocked merge only when their role is explicitly allowed to for every ruleset in play, and every bypass is written to your audit log.
All traffic to and from UnityFreak — the web app, the API, and git over HTTPS/SSH — is TLS-encrypted in transit.
SSO client secrets are encrypted at rest (AES-256-GCM). SCIM tokens are stored as a one-way hash — irreversible, never plaintext or a decryptable ciphertext. Your SIEM webhook secret is a server-only field, stripped from every organization API response regardless of role.
Your git repositories live on a dedicated block storage volume encrypted at rest by our infrastructure provider, and LFS objects are stored in object storage that encrypts all data at rest by default.
Nightly backups of your repositories and database run through restic, which cannot produce an unencrypted backup — encryption at rest is not an optional setting on our backup path.
Repositories and database back up nightly; Git LFS objects sync weekly. Not a manual, easy-to-forget process.
Backups live on a separate storage bucket from your live data, and the LFS backup sits on a different provider (Cloudflare R2) than the droplet itself — a single provider or bucket incident doesn’t take out both your live data and its backup.
Backup freshness is actively monitored — we’ve deliberately tested the alert path and confirmed it fires on a stale backup. A full restore drill (restore, integrity check, clone test) has been run end-to-end and passed.
Not mined for AI training data, not sold to third parties, not scanned beyond what keeping the service running requires. Every organization, every plan.
Request a complete export of your account data straight from your account settings — no support ticket required.
Consent for terms, privacy policy, marketing email, analytics, third-party sharing, and cookie preferences is recorded individually, not bundled into one blanket checkbox.
For organizations that need control over project conversations, not just the ability to have them.
Set a retention window for your organization’s project conversations. A scheduled job purges messages past that window automatically — not a manual, easy-to-forget cleanup task.
Place a hold — organization-wide, or scoped to a single project or person — that preserves messages through a snapshot before any edit or delete can proceed, independent of your retention window.
Export every governed conversation across your organization, including deleted messages — a message’s content and the fact that it was deleted are both preserved for legal and compliance review.
Route new messages to your own data-loss-prevention tooling via a signed, per-organization webhook. Your DLP tool can call back to redact a message; every redaction is written to your audit log.
Organization admins can remove messages from governed project conversations, even ones they’re not a participant in. Restrict project conversations to organization members only, or allow guests — your choice, per organization.
Third-party services we actually integrate with, and what each one is for.
| Subprocessor | Purpose |
|---|---|
| Stripe | Payment processing and subscription billing. |
| DigitalOcean | Primary infrastructure hosting and object storage. |
| Cloudflare (R2) | Object storage for Git LFS objects and data exports. |
| PostHog | Product analytics, gated behind cookie consent. |
| LiveKit | Real-time audio/video infrastructure for in-app calls. |
| Brevo | Transactional email — password resets and notifications. |
| Google (Gemini API) | AI-assisted features inside project management. |
Found a security issue? Email [email protected] with a description, reproduction steps, and any relevant logs or affected endpoints. Please don’t open a public issue, test against other users’ production data, or run automated scanners without coordinating with us first. We take every report seriously and will acknowledge it, but as a small, pre-launch team we don’t yet have a formal response-time SLA to publish.
Not shipped yet — listed here separately so it’s never confused with what’s verified above.
Tell us what you need reviewed — architecture, data flows, or a vendor security questionnaire — and we’ll walk you through it.