Security & reliability

The short version

Your content lives in your own GitHub repository, not in our database. PullPress holds the minimum it needs to run your account and workflow, asks GitHub for the narrowest permissions that still let editors work, and is designed so that even a full PullPress outage never locks you out of your content or takes your website down.

Your content stays in your repository

Every page, post and image your team edits is committed to your own GitHub repository through the GitHub App you install. Drafts are branches; published changes are merged commits with full history. Our database stores workflow metadata (accounts, review states, comments) — not a separate copy of your content.

That architecture is your strongest guarantee: your content is versioned by Git, hosted by GitHub, and fully portable. Stop using PullPress tomorrow and you keep everything, with history.

Sign-in and access control

Editors sign in with single-use, short-lived magic links sent to their email — there are no passwords to leak, reuse or brute-force. Writers never need a GitHub account.

Access is layered: workspace roles (owner, admin, member), site roles (editor, publisher, viewer) and optional per-collection restrictions, so a writer only sees what they are meant to touch. Every data access goes through a single workspace-isolation chokepoint on the server, so one workspace can never read another's sites or installations.

AI agents connect through the Model Context Protocol using OAuth 2.1 with PKCE and short-lived, rotating tokens, or scoped personal API tokens (stored only as hashes). Agents go through the same review flow as humans — they can draft and submit, never publish directly.

Minimal GitHub permissions

The PullPress GitHub App requests only what the editor needs: read/write on repository contents and pull requests, read-only metadata, and optional read-only checks. It deliberately has no access to Actions workflows, so even a compromised account could not modify your CI/CD pipeline through PullPress.

GitHub access uses short-lived, per-request installation tokens. Private keys and secrets stay in server-side environment variables and are never sent to the browser. Commits are attributed to the editor who made them, so your Git history stays honest.

Platform security

All traffic is encrypted in transit (HTTPS). Rate limits protect sign-in, saving, reviewing and invitations against abuse. Billing is handled by Stripe — we store a subscription reference, never card details.

Found a vulnerability? Report it to security@pullpress.app and we will respond as quickly as we can. Please give us reasonable time to fix an issue before disclosing it publicly.

Reliability and uptime

We target 99.9% availability for the hosted service and publish a public status page at /status — current status, 90-day uptime history and incidents, computed from our own health checks — plus a live health endpoint (/api/health) that independent uptime monitors can watch.

More important than any number is the failure model: PullPress sits beside your website, not underneath it. Your site is built and hosted from your repository by your own pipeline — if PullPress is ever down, your live website keeps serving, your content remains in GitHub, and nothing is lost; editing simply pauses until we are back.

Backups and retention

Content: protected by Git itself — full version history in your repository, stored on GitHub's infrastructure. Deleted or changed by mistake? Any previous version can be restored from history, in the app, without git commands.

Account and workflow data: stored in a managed Postgres database (Neon) with point-in-time recovery. We keep account data for as long as your account is active and remove it when you delete your account or workspace; your content stays in your repository, under your control.

Where your data lives

Your content lives wherever your GitHub repository lives, under your GitHub agreement. Our database holds the minimal account and workflow data described above, on managed infrastructure (Neon for the database, Netlify for hosting); the third parties we use are listed in the privacy policy.

If your organisation has specific data-residency or vendor-review requirements (questionnaires, a DPA, processing details), contact us at security@pullpress.app — answering them is part of the job, not an enterprise upsell.