Security teams should ask hard questions before adopting new tooling. Here are our honest answers — what we do, what we don't, and where the boundaries are.
Evidence collection underway via Vanta. Type II observation window closes Q3 2026; audit report expected late Q4 2026. Letter of engagement available on request.
Aligned to GDPR principles: lawful basis, data minimisation, right to access (export from /dashboard/settings → Account), right to erasure (delete account in same place). DPA available on request.
Stoney does not process PHI or cardholder data on customer behalf. We verify the rules your team writes for HIPAA/PCI compliance; we are not a covered entity ourselves.
Stoney is a binary that runs inside your own CI runners. It makes HTTP requests against your staging environment and checks the responses. No source code, no secrets, and no HTTP payloads are ever transmitted to Stoney's servers.
When you generate an API token, we display it exactly once. What we store is the SHA-256 hash — never the token itself. There is no recovery path; if you lose it, you revoke it and generate a new one.
The Jira integration requests read:jira-work, write:jira-work, and read:jira-user. Slack requests only the ability to post to a chosen channel. We never request admin or workspace management permissions.
Every action is gated by role. Owners manage billing and org settings. Admins invite members and manage tokens. Members can view runs. There are no escalation paths between roles.
Every security-relevant action — token creation, revocation, member changes, plan changes — is written to an append-only audit log. You can see who did what and when. (Audit log available on Pro plan.)
We use Vercel Analytics for anonymized, aggregate performance metrics only. No Google Analytics, no Facebook Pixel, no ad networks. Your usage data is not sold or shared with any third party.
Found a vulnerability? Please email us before public disclosure so we can address it responsibly.
We acknowledge reports within 48 hours and aim to resolve critical issues within 7 days.
security@stoneydev.comProcurement reviewing Stoney for adoption? Email security@stoneydev.com and we'll send the trust pack — typically within one business day.
GDPR rights — Customers can self-serve data export and account deletion from Settings → Account. For erasure of data after account deletion (e.g. backup retention), email the address above.