Security & data handling
ProdVerdict is a deterministic contract engine. Evaluation does not use LLMs. Secrets stay in your CI runner or local environment.
What we store
The cloud dashboard stores verdict metadata only: contract name, pass/warn/fail, structured findings, and timestamps.
We do not store Stripe subscription rows, Paddle customer data, database contents, or API keys in plaintext.
Audit log entries record action names, project IDs, and timestamps — metadata only, never billing rows or secrets.
Policy templates store your prodverdict.yml YAML as text for reuse across projects.
Where checks run
Access checks read billing and Postgres using credentials from your GitHub Actions secrets or local shell. Data is compared in memory on your runner and discarded.
Config, migration, boundary, and webhook checks scan your repository in CI — not on ProdVerdict servers. Restore smoke tests run your declared backup/restore commands on your runner.
Database access
Policy templates and audit events tables use RLS deny-all policies. The site API accesses them via service role only — not exposed to browser clients.
Fail-closed
STRIPE_SECRET_KEY, DATABASE_URL, or invalid config causes exit code 2 — never a silent pass.