Runs entirely on your machine.
Reads your codebase read-only, writes skene-context/journey.yaml into your repository. With lmstudio or ollama, nothing leaves the machine.
Security
What runs where.
This is the page to forward to your engineering lead or your security reviewer. What Skene can reach depends on which of the two products you run, so each one is answered separately below.
Skene OSS requests no access. Skene Cloud is scoped per repository.
Skene OSS runs entirely on your machine
MIT-licensed, no Skene account, reads your codebase read-only.
Never pushes to your default branch
Changes arrive as pull requests you review and merge yourself. No personal access tokens.
Supabase starts read-only
Schema introspection only. No row data, no table counts, never writes.
Access scopes / GitHub App4 permissions
- Contents
- Read & write
- Pull requests
- Read & write
- Issues
- Read & write
- Metadata
- Read
The managed version, plus what OSS does not do.
Adds pull request review, the journey canvas, and the record of launch checks. The MCP server is hosted; your coding agent connects with a workspace API key.
Access scopes
Four permissions, and what each is for.
Skene OSS requests no access. Skene Cloud connects to GitHub through the Skene GitHub App, scoped to the repositories you select.
- Contents
Read & write. Reading your code and
skene-context/files; committing updates back through pull requests. - Pull requests
Read & write. Reading diffs, posting reviews, opening fix pull requests.
- Issues
Read & write. Responding to
/skene fixcomments. - Metadata
Read. Listing the repositories the installation can access.
Skene Cloud makes two connections.
A workspace owner adds both. Supabase takes a production and an optional development project, assigned separately. GitHub holds one repository and branch.
- Exactly two roles, owner and member. No permission matrix to configure.
- Deploys and every write target the production project only.
Integrations/skene-dashboard
2 connected
- Supabaseconnected
- Productionacme-productionassigned
- Development databasenot assigned
- GitHubacme/webappmainconnected
Data retention
Skene OSS keeps nothing.
Skene Cloud purges the interaction events Flows captures after 90 days; a workspace owner can delete them sooner. Detailed personal-data retention times are available on request.
Settings / Data retention
| What | Kept for |
|---|---|
| Skene OSS output | Nothing |
| Skene Cloud personal data | Account duration |
| Flows interaction events | 90 days |
| Everything, on request | Immediately |
Third parties in the path
What each one does, and what it sees.
The third parties below are in the path for Skene Cloud.
| Service | What it does | What it sees |
|---|---|---|
| Vercel | Application hosting for the dashboard and the API | Request traffic, session cookies, API payloads |
| Supabase | Authentication, Postgres and storage | Accounts, workspaces, artifacts, encrypted secrets |
| OpenRouter | Gateway for the managed LLM analysis | Prompts, which can include repository and schema context |
| OpenAI | The default managed model, openai/gpt-5.6-terra, reached through OpenRouter | The same analysis prompts |
| Gap-analysis models and Skene Agent, through OpenRouter, Gemini and Cloud Run | Analysis prompts and agent chat context | |
| Resend | Transactional email from support@skene.ai: invites, welcome, onboarding, reminders and quota warnings | Email address and message content |
| Stripe | Billing and payments | Customer and payment metadata. Card details go to Stripe, not Skene |
| GitHub | The Skene GitHub App: link, webhooks, PR reviews | Repository metadata, PR diffs, review comments |
| Upstash Redis | Buffering on the event ingest path, when it is configured. Without it events buffer in Postgres instead | Buffered analytics events awaiting their scheduled drain |
| Upstash QStash | Fanning the scheduled ingest job out per workspace, when it is configured. Without it the job runs inline | Workspace identifiers, and the scheduling of the work rather than its contents |
Certification
Not SOC 2 certified today.
SOC 2 certificationROADMAP
It is on the roadmap and not yet started, and there is no date to give you. If a certification is a hard requirement for your procurement, say so early. Contact us and we will answer your security review directly.
What you keep if we go away.
- Your product data stays in the database you already own.
- Uninstalling the GitHub App withdraws all four permissions at once, from GitHub rather than from us.
- Skene OSS is MIT-licensed and public: if Skene Cloud stopped tomorrow, the tool still runs.