Security at CIHelper
We take security seriously and follow industry best practices to protect your data.
Honesty Rule
- CIHelper is a CI log analysis tool, not a security scanner or compliance auditor.
- We do not guarantee complete error coverage (some edge cases may not be recognized).
- We do not guarantee perfect accuracy (diagnoses are AI-generated and may require human verification).
- We do not guarantee zero false positives (occasionally we may identify the wrong root cause).
Data Handling
Data Collection
- CI logs submitted for analysis are processed in-memory
- Log data may be retained temporarily for model improvement (with user consent)
- No raw log data is shared with third parties
Data Security
- All data in transit is encrypted with TLS 1.3
- API keys are stored securely using industry-standard practices
- Audit logs track API usage and access patterns
Data Retention
- Free tier: 30 days of diagnosis history
- Pro tier: Unlimited history with export options
- Users can delete their data at any time
Compliance
GDPR Compliance
- Data processing is GDPR-compliant with proper consent mechanisms
- Data subjects have the right to access and delete their personal data
- DPO contact information available upon request
OWASP Guidelines
- API security follows OWASP API Security Top 10 guidelines
- Input validation prevents injection attacks
- Rate limiting prevents abuse
API Security
Authentication
- API keys required for all programmatic access
- Keys should be stored securely and rotated regularly
- Never expose API keys in client-side code or public repositories
Rate Limiting
- Free tier: 60 requests per hour
- Pro tier: 1000 requests per hour
- Enterprise: Custom limits available
Audit Logs
- All API calls are logged with timestamps and user identifiers
- Logs are retained for 90 days for security review
- Access to audit logs requires admin privileges
BYOK (Bring Your Own Key)
BYOK is available for enterprise customers. Contact our sales team for details.