Your data
stays yours.
Rerove is the decision ledger for your codebase. It records why every change merged.
To do that, it reads your code — so this page explains exactly what we store, send, log, and delete.
Rerove matters most where a merge can break more than a build. In these industries, product alignment is a security, compliance, and communications requirement — not a preference.
Every pull request is checked against your specs and guardrails, and the decision is recorded. That is why these teams run Rerove on every change.
The control your AI coding workflows are missing
Rerove reviews every pull request against what your product intends, and its verdict lands as a check on the merge.
Every decision is recorded — who reviewed, what was found, how it was resolved, and when. When your auditor asks “show me oversight of AI-written code,” you export the record instead of reconstructing it.
- A recorded, independent review on every pull request
- Findings and resolutions retained per change
- Timestamps that show when review happened
- Exports for SOC 2 change-management evidence
Frequently asked questions
Does Rerove execute my code?
No.
Rerove reviews code. It never executes repository code, and there is no code-execution environment in the product.
Do you train AI models on my data?
No.
By contract, not by policy. Rerove never trains models on your data, and neither do our model providers.
Do you share my data with third parties?
We use your data for one purpose — providing the service.
Every subprocessor that touches it, Amazon included, is on our published list and bound by a data processing agreement. We never sell your data.
Do you store my source code?
Your code is processed on audited, isolated, encrypted infrastructure. Each organization gets its own storage access point, and your workers can only ever mount your code.
If you close your account, we delete your data.
Can your employees access my code?
Only with your authorization.
Rerove personnel who access your code and customer data are based in the United States and Poland (European Union). Access follows your instructions and is logged. Rerove does not access your own end-user data; do not send or import it into the service.
Can another customer see my data?
No.
Your data is reachable only through your account. Your files sit behind a dedicated access point — separated from other organizations — and every record is scoped to your organization.
Where is Rerove hosted?
Exclusively in the United States, on AWS infrastructure audited by an independent AWS Partner.
Who operates the AI models?
A mix of models from Anthropic and others.
Every model runs in the United States and is never trained on your data. Each provider is listed on our subprocessor list and bound by a data processing agreement.
Are you GDPR compliant?
Yes.
Our data processing agreement and dated subprocessor list are linked below. A signed PDF with the same agreement text is available on request.
Are you CCPA compliant?
Yes.
We do not sell personal information, and we honor access and deletion requests. The details live in our privacy policy.
Are you SOC 2 compliant?
Yes.
Rerove is SOC 2 Type I compliant, confirmed by an independent auditor. The report is available on request. The Type II process is expected to complete in Q4 2026.
Can I exclude sensitive files?
Yes.
Add a .reroveignore file to your repository, or set exclusions in the interface. Anything listed is excluded from analysis and never sent to a model.
Do you support self-hosting?
Enterprise plans include options for dedicated infrastructure and data residency requirements. Talk to us about your setup.
What happens when we offboard?
All customer data is available to you throughout the service: review results are in your GitHub, and the decision ledger is accessible through MCP. Offboarding deletes your organization and starts the deletion process. Server logs and backups follow their own retention periods, as described in section 6 of our privacy policy. Written confirmation of deletion is available on request.
Everything procurement asks for.
Can you access my code?
Only when you ask. Always on the record.
Access to your data is a governed operation: it starts with your request, it’s scoped to your ticket, and it closes with a receipt.
Every touch lands in an audit log built to SOC 2 evidence standards — and the log belongs to you. It ships with your workspace, exportable by your admins, line by line.
Ask your current vendor to show you their access log. We show you ours.
2026-07-03T14:12:08Z access.requested actor: support@rerove.app reason: "ticket #4821 - review stuck on PR 1204" scope: org/acme · read-only 2026-07-03T14:12:41Z access.approved approved_by: you@acme.com 2026-07-03T14:20:17Z access.closed duration: 7m36s · records_touched: 3 export: available to org admins
Questions about security?
We are happy to walk through our security architecture, answer your questionnaire, or discuss your specific compliance needs.
Talk to us