Security and data
How heyGRC handles code in review: secret stripping, transient diffs, worker location, default inference path, optional EU inference, and where binding legal docs live.
Short operational summary. Binding legal documents (Terms, Privacy, DPA, subprocessors) live on the shared ISMS Copilot trust center. Product narrative also: heygrc.com/trust.
Code handling (plain terms)
- Secrets are stripped before review. Sensitive files and secret-shaped content are dropped or redacted before a diff is sent to a model.
- Source is reviewed, not retained as a corpus. The diff is processed transiently to produce the review. heyGRC stores review outputs (summary and findings), not your full source tree as a long-term store.
- Least privilege. The GitHub App permissions are minimal (GitHub App permissions). API keys are org-scoped; a key only acts on its own org.
- Does not block merges by default. Neutral Checks + comments; you decide gates.
Where work runs
- Review worker: runs in Paris. That is the job queue and GitHub API control plane. It is a location fact, not a claim that US teams are out of scope.
- Default inference path: vetted providers via the same allowlist posture as ISMS Copilot (zero retention / no training on that path; formal transfer details in the DPA). Region of inference on the default path is not the same claim as "contractual EU inference residency." US customers use this path unless they opt into EU inference.
Optional EU inference
Organizations can turn on EU inference in the console (Settings) or via eu_inference on PUT /v1/config. When on, compliance reviews go to Mistral on the EU regional endpoint, with no silent fallback to the default global path. Quality and large-PR coverage can differ.
Default orgs stay on the global path. How-to, API field, and honesty notes: EU inference.
Included with ISMS Copilot (what is checked)
When you activate the ISMS Copilot inclusion on the Plan page, heyGRC checks the subscription status of your own ISMS Copilot account to decide whether the org gets included reviews. Same controller (Better ISMS), one login across both products, no new processor. Only the entitlement answer is read, plan level and status. No email address and no payment data are copied into heyGRC. Release the inclusion and the check stops.
Optional website support chat (third party)
When enabled on docs.heygrc.com (and marketing/console), a Chatbase AI support widget may load. That chat is US-hosted. Conversations can be processed by Chatbase and its model providers. Do not paste secrets, tokens, or unnecessary personal data into the widget.
- Prefer email support@ismscopilot.com if you do not want US-hosted AI chat.
- The assistant cannot access your GitHub org, installations, or heyGRC console data.
- Binding privacy and subprocessors live on the ISMS Copilot trust center. Chatbase should appear there before the widget is turned on in production.
Service status
Live status and incident reports for the shared Better ISMS infrastructure, heyGRC included: status.ismscopilot.com.