Security
Data deletion SLAs, retention limits, and controls for repository and secret access.
Ellipsis deletes data within 4 hours after its time to live (TTL) expires.
Data retention
| Data | Retention limit |
|---|---|
| Session data | Customer-configured TTL from 0 hours to 1 year |
| Other retained operational data, including webhook payloads | Maximum TTL of 3 days |
A TTL of 0 hours adds no retention window. The 4-hour deletion SLA still applies.
For example, data that expires at 12:00 UTC must be deleted by 16:00 UTC. Export any records you need before their TTL expires.
GitHub access
Select which repositories the GitHub App can access, then restrict the credentials issued to each session:
- Read-only GitHub access prevents pushes and issue or pull request comments. Local sandbox edits remain possible
- Explicit GitHub permissions grant only the operations a task needs
- Environment repositories select what is cloned. Credential permissions separately control repository access
Code review has its own permission restrictions. Ellipsis posts the final review separately from the stage agents.
Secrets
Store credentials as secrets and reference only those a session needs. Stored values cannot be read back through the dashboard or API.
Processes and tools can read credentials injected into their environment. GitHub read-only permissions do not restrict those separate credentials. Keep secrets out of prompts, committed YAML, cached configuration, and tool output; session logs can contain what tools print.
API access and webhooks
Keep API keys on your server. Limit Ellipsis permissions on credentials issued to sessions.
Verify webhook signatures before accepting events. Check the signature against the raw request body and reject stale timestamps.
Contact
For security questions or deletion requests, contact Support. Do not include secret values.