Honest Cheetah for GitHub: Privacy & Security
Last updated 2026-09-13. Covers app.honestcheetah.com.
The short version
Your planning data stays in GitHub. Honest Cheetah reads it with your own GitHub sign-in, every time, and writes to it only when you click a button that says so. What Honest Cheetah keeps on its own servers is the part GitHub has no place for: test cases, test runs and their results, the screenshots and recordings attached to them, and the metric history a board needs for a forecast. All of it is partitioned by your GitHub organization, stored in Microsoft Azure in the US East 2 region, and encrypted at rest and in transit. Your GitHub token is never written to our database.
How it's built
Honest Cheetah for GitHub is a hosted web application. There is nothing to install in your GitHub organization for the current product; you sign in with GitHub and the app reads your boards on your behalf.
- The app at app.honestcheetah.com: an ASP.NET Core application on Azure App Service that serves the browser client, handles sign-in, and makes every call to GitHub.
- The data service: a second ASP.NET Core application, reachable only by the app, that owns the database and the evidence store. It never talks to GitHub and never sees your GitHub token.
- The database: Azure Cosmos DB, one container, partitioned by GitHub organization.
- The evidence store: Azure Blob Storage, private containers, for screenshots and screen recordings.
- The AI: Anthropic's Claude models, called over Anthropic's API from the app. See What the AI sees.
Signing in, and what happens to your token
You sign in with GitHub. Honest Cheetah creates no accounts and stores no passwords; whatever GitHub requires of you, including two-factor authentication and single sign-on enforced by your organization, is what Honest Cheetah requires. The authorization asks for access to your repositories and Projects boards and to read your user profile and which organizations you belong to. The public listing is github.com/apps/honest-cheetah.
- Your GitHub access token lives in an encrypted, HTTP-only, secure, same-site session cookie in your browser. It is not written to the database. When GitHub rotates it, the new token replaces the old one in the same cookie.
- Every request the app makes to GitHub carries that token, so GitHub's own permission model decides what you can see and its audit trail records what you did. If you can't see a project in GitHub, you can't see it in Honest Cheetah.
- The app talks to the data service with its own short-lived signed tokens, valid for five minutes, that name you and your organizations. Your GitHub token never crosses that boundary.
- Server logs record a fingerprint of the token, never the token.
- Signing out discards the cookie. Revoking Honest Cheetah under your GitHub account's authorized applications ends access from GitHub's side; there is nothing on ours to revoke.
Which organizations you belong to is read from GitHub at sign-in and rechecked from GitHub about once a minute while you use the app. Most company organizations restrict which OAuth apps can see their data, and until an owner approves Honest Cheetah your organization simply doesn't appear. Nothing about it is read.
What it reads from GitHub, and when
Reads are live. There is no background sync, no webhook subscription, and no cached copy of your board: when you open a page, the app asks GitHub for what that page shows, using your token, and shows it. Close the tab and the reading stops. Specifically, the app reads:
- Projects v2 boards: items, fields, statuses, iterations, backlog order, and the issues and sub-issues behind them, including titles, bodies, labels, and issue types.
- GitHub Actions workflow runs and pull requests, when you bind a test run to one.
- A repository's description, README, and agent instruction files (AGENTS.md, CLAUDE.md, .github/copilot-instructions.md) when the AI needs context for a draft or a review. No other files, and never the code.
Issue bodies and comments are displayed while you look at them and are not kept, with one exception: the Azure DevOps import holds work items in a staging area until it completes (below).
What it writes to GitHub
Nothing, until you click a button that says it will. Every write uses your own token, so in GitHub's history it was you. The things Honest Cheetah writes, each behind a button: issues and sub-issues, their statuses, iterations, and backlog order; a project board, repository, and sample backlog when you ask the project factory for one; a Bug issue filed from a failed test result; and the issues created by an import from Azure DevOps. The AI never writes; it proposes, and you click or you don't.
What it keeps on its own servers
Everything below is stored in Azure Cosmos DB, keyed by your GitHub organization's id, and belongs to that organization.
Verification
- Test cases: title, steps, tags, priority, lifecycle, review disposition, every version, and the GitHub issue each one verifies.
- Test runs and results: outcomes, per-step outcomes, notes, the name of who or what performed each result, who recorded it and through which channel, when, and what build or environment the run was bound to (repository, commit, workflow run id, pull request, or the text you typed).
- Evidence records: for each screenshot or recording, its filename, size, which step it belongs to, who captured it, and when. The bytes live in the evidence store.
- Suites, and a record of each bug filed from a run: the GitHub issue number and link, its title, and who filed it.
Planning and metrics
- Metric history: one record per completed item, with its issue reference, title, completion date, and cycle and lead time in days, labelled with where it came from (imported from Azure DevOps, or generated sample data). Live completions are computed from GitHub when you look, not stored.
- Project settings: which statuses mean started and finished, the Definition of Done text, and each user's pinned projects.
- AI results: the review findings and suggested text for a requirement, and the verdict on whether a project has enough context for a draft. Each is tied to the issue it is about and to the version of it that was reviewed.
- AI usage: per call, the organization, the user, the feature, the model, and token counts. Not the prompt, and not the response.
Titles of GitHub issues are kept alongside the records above so that a test run or a metric row is readable after the issue changes. Nothing else from GitHub is copied.
What it does not keep: issue bodies or comments (outside an import in progress), source code, pull request contents, GitHub tokens, passwords, or anything from an organization you haven't opened in Honest Cheetah.
Screenshots and recordings
When you attach a screenshot or record your screen during a test run, the browser uploads the bytes straight to a private container in Azure Blob Storage under a short-lived upload link the data service hands out for that one file. Nobody outside Honest Cheetah can list or read the container. Evidence is served back only through the app, to people who can see the organization it belongs to.
- Evidence on a completed run is frozen with the run. It cannot be edited or replaced.
- Uploads that never finished (a closed tab, a crashed browser) are swept and deleted.
- Evidence is not deleted when a subscription lapses or a person leaves the organization. The verification record does not get holes in it.
- Screen recording and screenshot capture happen only after you grant the browser's own permission prompt, and only for the tab or screen you choose.
What the AI sees
AI features call Anthropic's Claude models over Anthropic's API. Each call sends what that feature needs and no more: the requirement in front of you (title and body), its test cases if the feature is about them, the project's description, README, and agent instruction files for context, and, for the metrics explainer, the numbers Honest Cheetah already computed. The model never sees your code, your other organizations, or anything Honest Cheetah stores for anyone else.
- Every AI output is a draft. Nothing reaches GitHub without a click.
- Honest Cheetah keeps the result (a score, findings, suggested text) and the token counts. It does not log or store the prompt or the raw response.
- Each organization has a monthly token ceiling. When it is spent, the AI buttons stop until next month and everything else keeps working.
- Data sent to Anthropic's API is governed by Anthropic's commercial terms, under which API inputs and outputs are not used to train Anthropic's models.
Importing from Azure DevOps
The import reads a team project with a personal access token you create in Azure DevOps with read-only scopes. The token is held in the browser tab and sent as a header on each read request. The server keeps nothing between requests, the data service never receives it, and the log records a fingerprint of it, not the token. When reading ends, the token is forgotten; closing the tab has the same effect as revoking it.
The work items being imported (requirements, tasks, test cases, and shared steps, with their fields) are held in a staging area, partitioned to your organization, until the import completes or you discard it. On completion the staging area is reduced to an origin map, which work item became which issue or test case, and nothing else is kept. Nothing is ever written back to Azure DevOps.
Tenant isolation
Every stored record carries the GitHub organization it belongs to, and that value is the database partition key. The data service accepts a request only with a token from the app naming the user and the organizations GitHub says they belong to, and every query is scoped to one of those organizations. There is no cross-organization query path in the application. The demo organization is shared sample data that any signed-in person can browse; writes to it are refused.
Encryption and credentials
- In transit: HTTPS with TLS 1.2 or better between the browser and the app, the app and the data service, the app and GitHub, the app and Anthropic, and the data service and Azure.
- At rest: Cosmos DB and Blob Storage encrypt everything with Microsoft-managed keys.
- Service credentials: the app and the data service authenticate to Cosmos DB and Blob Storage with Azure managed identity. There are no database keys or storage keys in configuration or code.
- Your credentials: your GitHub token is in your session cookie only. Your Azure DevOps token, during an import, is in your browser tab only.
Hosting and data residency
| Component | Provider | Region |
|---|---|---|
| The app and the data service | Azure App Service | US East 2 |
| Database | Azure Cosmos DB | US East 2 |
| Evidence store | Azure Blob Storage | US East 2 |
| Telemetry | Azure Application Insights | US East 2 |
| Sign-in and planning data | GitHub | Per your GitHub plan |
| AI | Anthropic API | Per Anthropic's terms |
Microsoft, GitHub, and Anthropic hold their own compliance certifications (Azure, GitHub, Anthropic). Honest Cheetah's data residency is the US East 2 region; GitHub's is whatever your GitHub plan provides.
Logging and telemetry
- Both the app and the data service send server-side performance and error telemetry to Azure Application Insights, Microsoft's application monitoring service. The browser client sends none; there is no analytics script in the page.
- Application logs include your GitHub user id and organization id where they are needed to diagnose a request, and fingerprints of tokens. They never include a GitHub token, an Azure DevOps token, an issue body, or an AI prompt.
- Sign-in failures and token refresh failures are logged.
- Logs live in Azure-managed infrastructure with access limited to the people who operate the service.
When a trial ends, when you leave
- Day 16 of a trial: the organization is locked, not erased. Everything stays where it was for 90 days. Subscribing in that window restores it intact. After 90 days it is deleted.
- Everything Honest Cheetah wrote to GitHub is yours and stays on your board whether or not you ever open Honest Cheetah again.
- Deletion or export on request: support@honestcheetah.com. A person reads it.
- Your own access: revoke Honest Cheetah under your GitHub account's authorized applications. There is nothing else to revoke, because the only credential was in your browser.
GDPR
- Personal data held: your GitHub user id and login, the organizations GitHub says you belong to, your pinned projects, your name as it appears on test results you performed or recorded, and your AI usage counts.
- You can ask for access to, correction of, or deletion of that data at any time.
- Sub-processors: Microsoft Azure (hosting, database, storage, telemetry), GitHub (sign-in and source data), Anthropic (AI features).
- A Data Processing Agreement is available on request.
Questions
Privacy or security questions: support@honestcheetah.com.