Security & data handling

How HeyDeer accesses repositories, runs reviews and fixes, and stores data.

HeyDeer never stores your code: every review and fix works on a temporary clone that’s discarded when the work ends. HeyDeer never uses your code to train AI models.

Repository permissions

Install the GitHub App with “Only select repositories” to limit access to the repositories you want reviewed.

Checks Read & write: Create and update the HeyDeer Review check to show review progress and results. Check publishing requires this permission; review comments can still be published without it.
Contents Read & write: Read source and Git history, resolve or reopen HeyDeer’s review conversations, and push commits for fixes and @heydeer requests. Changes go to a new branch unless the PR is HeyDeer’s own or you ask otherwise, and pushes never overwrite commits on a branch.
Pull requests Read & write: Read pull request details, publish reviews and comments, and open, update or merge pull requests when you ask. HeyDeer never merges a pull request from a fork or pushes a fork’s commits.
Repository metadata Read: Read basic repository information required by GitHub Apps.
Issues: read and write: Receive PR comment commands, add and remove 👀 on review requests, and read related issues and PRs when Read related issues and PRs is on.
Organization members: read: List workspace members and admins, and check organization and team membership when your review filters use member or team rules.
Email addresses: read: Use your verified primary email for billing and credit reminders. Sign-in remains available without this permission.

HeyDeer requests Workflows write access to publish fixes to GitHub Actions workflow files. It does not request Administration access. Tokens are scoped to one repository and the permissions needed for each step.

Review and fix processing

HeyDeer clones the repository into a non-persistent Vercel Sandbox in one of Vercel’s US regions: Washington, D.C., Cleveland, San Francisco or Portland. Review agents read the source code; they do not run it, its tests or its dependencies. The environment has a time limit and is stopped during review cleanup.

Starting a fix or mentioning @heydeer authorizes an agent to clone the repository, edit code, install dependencies, and run local checks in a temporary sandbox with public internet access. Repository scripts and dependencies can send data to external services. HeyDeer isolates tasks and protects platform credentials; it does not prevent that outbound traffic.

Fix with HeyDeer

Model services

HeyDeer does not use your source code, instructions, or review and fix results to train its own AI models.

Reviews and fixes use OpenAI, Anthropic, Kimi and GLM models. HeyDeer calls OpenAI and Anthropic models directly or through AWS Bedrock, OpenRouter and Vercel AI Gateway, and Kimi and GLM models through those three providers. HeyDeer stores results and history separately; services you connect follow their own data policies.

OpenAI data controls Anthropic data usage

Optional connectors

If you add a connector, review and task requests to that service may include code or task context. You choose which services to connect, the credentials they use and the tools HeyDeer may call. Private connectors are left out of public repositories and of changes from forks or people without write access. The sandbox adds the credentials to outgoing requests, so the agent never sees them.

Credential boundaries

GitHub credentials used to publish reviews and task changes stay in the application backend and are not passed to agents. Source-fetch credentials are scoped to read the selected repository and stay outside the agent’s reach.

Processing uses these infrastructure and model services and is not restricted to Singapore.

Stored data and retention

Review and fix results are stored separately from their temporary environments and remain available after those environments stop.

HeyDeer stores review and fix results, selected findings and instructions, repository and PR identifiers, account and workspace information, settings, and billing records. Review results can quote the lines they comment on.
Published review comments, fix commits, and fix PRs remain on GitHub under the repository’s controls.

HeyDeer does not currently publish a fixed retention period for all stored records, logs, and backups, or provide self-service deletion of workspace data. Provider and connector records follow the applicable policies of those services.

Code handling and model provider policies

Privacy & security · hey@heydeer.ai

Managing access

Select individual repositories when installing the GitHub App.
Start reviews manually. Automatic reviews stay off until a workspace admin turns them on: when HeyDeer asks after setup, for the workspace in Workspace settings → Review rules, or for selected repositories in Repositories.
Fixes and @heydeer requests start only when someone with repository write access asks, and each action needs that person to still have write access. Opening a Fix with HeyDeer link does not start an agent or spend credits.
Remove repositories from the installation or uninstall the app in GitHub to revoke access.

Installation changes control future GitHub access. An in-progress review or task may still have its existing code copy; saved history and provider records follow the retention details above. Turning off automatic reviews applies to future reviews.

Manage personal GitHub App installations

For an organization, manage the installation in that organization’s GitHub settings.

GitHub, OpenAI, Anthropic, Kimi, GLM, AWS and OpenRouter names and logos are the property of their respective owners. Vercel, the Vercel design, Next.js and related marks, designs and logos are trademarks or registered trademarks of Vercel, Inc. or its affiliates in the US and other countries.