Security & trust
Your source code is the asset. We built like it.
Coverli tests design systems for enterprise and government teams — which means our customers' component source, unreleased UI, and compliance posture pass through our pipeline. This page states plainly where your code goes, who can see it, what we store, and what we deliberately never do. If a claim here matters to your procurement process, ask us to evidence it — we would rather show the machinery than assert the outcome.
The short version
- Your repository is checked out only inside ephemeral, single-use CI machines that are destroyed after the run. Coverli's platform stores test evidence like transcripts, screenshots, findings. Coverli never stores a copy of your repository.
- Your build never shares a machine step with our secrets. The job that runs your build commands holds no platform credentials at all — by invariant, not by convention.
- Every credential is per-run and short-lived: upload tokens are minted per run, revoked after it, stored only as hashes, and masked in CI logs. Repository access tokens expire in about an hour.
- AI is used in one place and always with your explicit approval, the audit, with your source treated as untrusted data. It is opt-in per audit scope, hardened against prompt manipulation, floored by deterministic checks no model can override, and your code is never used to train models.
- A self-hosted mode exists for teams whose source cannot leave their infrastructure: the tests run in your CI, and only the captured evidence reaches Coverli.
Where your code goes
The managed pipeline, step by step:
- 01
You install a GitHub App with minimal, read-mostly permissions
Repository contents (read), commit statuses and pull-request comments (write), metadata (read), organization membership (read — used only to verify that the person linking an installation actually belongs to your organization; nobody can bind your installation to their team by guessing a repository name).
- 02
A run checks your repository out on a fresh, single-use CI machine
The repository token expires in an hour. Checkout credentials are never persisted to the working copy, so nothing that runs later in the job can lift them.
- 03
Your Storybook builds, your components are tested
Evidence is captured: spoken-output transcripts (text), screenshots (content-addressed images), normalized markup excerpts, the accessibility tree.
- 04
Evidence uploads to your team's workspace; the machine is destroyed
The repository copy dies with it. What persists on Coverli is the evidence and its review history — never your repository.
Your build cannot see our secrets
No job ever holds both a customer build command and a platform secret. The jobs that hold platform credentials never execute customer code. This is enforced in the pipeline's structure and checked in review.
If your build needs private package registries, build secrets are write-only from the moment you save them: encrypted with keys held outside the database, decrypted once per run inside the build job only, masked in logs, never readable back through any interface — including ours.
One tenant boundary, enforced in the database
Every piece of evidence belongs to a team, and team isolation is enforced in the database itself. Roles (owner, admin, reviewer, viewer) gate spending from reviewing; every approval, rejection, settings change, and membership change lands in an immutable activity trail with who and when. That trail is the same governance artifact our product sells — we run on it too.
AI, stated plainly
One feature uses a large language model: the accessibility audit. Facts a security review will want:
Scope
Audit passes send the audited component source (and, when you opt in, approved test evidence) to our model provider. The regression-testing pipeline — screen readers, visual capture — involves no model at all.
A deterministic floor no model can override
Mechanical checks run before any model pass, at zero model involvement. Their findings stand regardless of what any model says — an audit can never be talked out of its mechanical facts.
Not used for training
Under our provider agreement, audit content is not used to train models.
Everything is traceable
Each finding records the files opened and searches run to reach its conclusion — the audit trail shown on every report.
What we store, and for how long
Stored: transcripts (text), screenshots (private storage, content-addressed, served via short-lived signed links), markup excerpts and the accessibility tree for changed stories, findings, baselines, review history, and the metadata that ties evidence to a commit.
Not stored: your repository, your build artifacts beyond the run, your registry credentials in readable form, any long-lived access token.
Evidence is retained while your account is active — baselines and approval history are the product's memory, and deleting them silently would defeat the point. Deleting a project removes its runs, baselines, and evidence; account deletion removes the tenant. Enterprise agreements can fix specific retention windows.
Self-hosted mode: code that never leaves
For teams whose policies do not allow source on third-party infrastructure, Coverli runs in your CI: your machines check out your code, run the same engine, and upload only the captured evidence — transcripts, screenshots, results — to your Coverli workspace for review, baselines, and reporting. Coverli never receives a checkout token and never touches your repository. Available on enterprise plans.
Platform hygiene
- All traffic is TLS; data is encrypted at rest by our infrastructure providers.
- The dashboard ships a strict Content-Security-Policy (no inline scripts, allow-listed origins only), HSTS, and frame-denial headers.
- Webhooks are signature-verified before a byte is processed.
- Every public surface is rate-limited; upload payloads are size-capped and sanitized field by field; anything trimmed is reported, not silently dropped.
- Error monitoring is configured to exclude personal data from reports.
- Sign-in is via GitHub single sign-on; Coverli never sees or stores a password.
Subprocessors
We keep the list short on purpose:
| Provider | Purpose |
|---|---|
| GitHub | Source hosting integration, CI execution (managed mode) |
| Netlify | Application hosting and APIs |
| Supabase | Database, authentication, evidence storage |
| Anthropic | Audit model passes (audit feature only) |
| Sentry | Error monitoring (no personal data, no customer code) |
No advertising or analytics networks touch customer data.
What we don't claim
The same honesty rule as everywhere else on this site: we would rather tell you than have you find out during a pilot.
No third-party certification yet
SOC 2 is on our roadmap; security questionnaires get complete, written answers today, and our internal security reviews — including findings and fixes — can be walked through under NDA.
Single region
The platform runs in North American infrastructure today; regional hosting is an enterprise conversation, not a toggle.
The audit's AI hardening is defense-in-depth, not a proof
That is exactly why the deterministic floor and the per-finding audit trail exist — the parts that cannot be manipulated are the parts we anchor on.
Report a vulnerability
Security reports go to dev@xdsystems.co. We acknowledge within two business days, we don't play games with reporters, and we credit fixes when reporters want credit.