Last updated: 9 November 2026
GitComet is developed by AutoExplore Oy. Security reports and questions can be sent to gitcomet@gitcomet.dev.
Repositories and external services
GitComet works with repositories on the device. Normal desktop use does not upload local repositories to AutoExplore. Git operations and Pro forge features communicate with the chosen provider; forge credentials use the operating system's credential store. Pro's local repository approvals govern its forge features, not ordinary Git transport or external coding agents.
Network activity also includes update checks and remote images in Markdown previews. Pro's optional AI features send changes and other context to the provider the user configures, under the user's own account or API key. Support requests, in-app reports, contributions and crash reports can contain information the user chooses to share. The Privacy Policy describes these cases and their controls.
Hosting and location
The public website, documentation and waitlist use Microsoft Azure. The Pro account and sign-in services use Amazon Web Services, bought through the AWS partner Cloudvisor, UAB (Lithuania), which retains administrative access to our AWS accounts.
The Pro servers, database and backups are in AWS's Stockholm, Sweden region. The content delivery network terminates connections and forwards account traffic from locations worldwide; firewall request logs and the delivery network's certificates and firewall configuration are in the United States. This is separate from Azure's delivery of the public websites.
These arrangements do not support a claim that all account processing or storage stays in the EU. Other providers have their own international processing arrangements, as described in the Subprocessor List.
Access and encryption
Connections are encrypted in transit, between browsers or the desktop and our delivery network, from the delivery network to our servers, and between the application and its database. Stored data, including the database and backups, is encrypted at rest. The database accepts no connections from the internet, and the servers are administered through audited sessions without public remote-login ports. Production and development run in separate AWS accounts. Infrastructure changes and releases are applied by automated workflows using short-lived credentials.
The account service owns sign-in sessions and uses a self-hosted identity service on a separate domain, so that sign-in and application cookies are never shared. It supports additional authentication factors and requires a recent additional identity check for sensitive actions. Organisations can configure single sign-on after proving control of a domain.
Stored credentials are protected according to their purpose, including non-reversible token digests and encryption for values that must be recovered. Forge credentials belong on the device rather than in the account service. Removing an account or signing out is not a guarantee that all local files, AI notes, agent histories or provider-side authorisations have been erased.
Pro licences are signed and verified by the desktop. Signature verification is the licensing security boundary. Certificate pinning is an additional measure; it is not a substitute for validating the signed licence. Revoking a device prevents further authorised service use, while an already-issued local licence may remain usable until it expires.
Abuse prevention and monitoring
The service includes request limits, sign-in protections, event records and monitoring. Errors in the API, the background worker and the identity service, and errors and freezes the account application reports from browsers, raise alerts and appear on an error dashboard. A web application firewall applies rate limits and blocks known malicious inputs. Its broader managed rule sets currently run in observation mode while we confirm they do not block legitimate use; we may switch them to blocking after that review.
Operational logs may include IP addresses, request paths and headers, account-related identifiers, errors and performance information. Firewall request logs remove credentials, cookies, internal tokens and query strings. The database does not log statements or their parameters, although error messages can contain personal data. Application audit records cover sign-in, devices, licences, billing, organisations and account lifecycle events. Retention and the limits of account deletion are set out in the Privacy Policy. We do not make an absolute promise that secrets or personal data can never appear in a diagnostic record.
Administrative activity on our AWS accounts and servers is recorded for a limited period, as set out in the Privacy Policy.
Backups and recovery
The Pro database is backed up regularly to encrypted storage in the same region, and backups are kept for a limited period, as set out in the Privacy Policy. Account deletion does not immediately remove data from existing backups. There is no standby region: recovery restores the service from these backups.
Targets in our engineering runbooks are objectives, not contractual service levels.
Application and development controls
The account service serves its application resources from its own origin, with a restrictive content security policy and no third-party analytics, advertising tags or externally loaded fonts. The application includes open-source software dependencies; serving resources locally does not mean it contains no third-party code. Its pages tell search engines not to index them.
The public websites have their own content security policies. Google Analytics loads only after a visitor accepts it, and the YouTube player on video pages loads only when the visitor presses play. Fonts are self-hosted.
Development checks include automated tests, dependency and licence checks, security scanning and automated checks of infrastructure changes. These checks provide evidence about the code and configuration; they are not a certification.
Reporting a security concern
Write to gitcomet@gitcomet.dev about vulnerabilities, suspected account compromise, leaked credentials, malicious downloads or impersonation. Include enough information to reproduce the issue, with sensitive details shared privately. For vulnerability reports, tell us how you would like to be credited.
We aim to acknowledge reports promptly and keep you informed. If an account appears to be actively misused, say so in the subject.
For research conducted in good faith, within your own accounts, without accessing or changing other people's data or disrupting the service, and with reasonable time allowed for a fix, we will not pursue legal action against you for that research. Contact us before automated scanning of a live service.
Incidents and assurance
Our incident procedures cover investigation, containment, recovery and communication. We assess personal-data breaches and notify the relevant authority and affected people where required by law, including the applicable 72-hour authority-notification requirement.
AutoExplore holds no security certification. Provider certifications do not certify GitComet. We review these descriptions from time to time.
Related
AutoExplore Oy, Annankatu 11, 53100 Lappeenranta, Finland
Business identity code 3495946-3