Security controls,
stated plainly.
For security teams conducting vendor assessments. Everything Blue Mantis holds, touches, and refuses to do — with honest status on what is live, what is in progress, and what is not yet built.
Last reviewed: August 2026
Green = live and verifiable · Amber = in progress with target date · Grey = planned. We update this table when status changes.
What Blue Mantis
processes on your behalf.
- What
- Work item titles, descriptions, acceptance criteria
- Source
- Jira / Azure DevOps
- Stored by BM
- Metadata only (title, status, AC count)
- Sent to AI
- Yes — included in the case file per run
- What
- Up to 8 source-code file sections per run — 5 via keyword extraction, 8 via the Graphify knowledge graph — selected by relevance to the work item
- Source
- GitHub / Azure Repos
- Stored by BM
- Not stored. Read at run time, sent to agents, discarded.
- Sent to AI
- Yes — the file sections selected for the run
- What
- Run status, timestamps, agent scores, PR URLs, commit hashes, Synthesia scores, Aegis findings (structured, not raw code)
- Source
- Generated by Blue Mantis
- Stored by BM
- Yes — in Supabase PostgreSQL
- Sent to AI
- No
- What
- API tokens for Jira, GitHub, Azure DevOps, Confluence, Notion
- Source
- User-provided
- Stored by BM
- Yes — per-user, in Supabase. TLS in transit.
- Sent to AI
- Never. Credentials are never included in any AI prompt.
- Logged
- Never. Credential values are never written to any log.
- What
- Email address, name, OAuth identity
- Source
- Sign-up
- Stored by BM
- Via Clerk (authentication provider)
- Sent to AI
- No
- What
- Action names, timestamps, IP addresses, entity IDs
- Source
- Generated by Blue Mantis
- Stored by BM
- Yes — 30–365 days depending on plan
- Sent to AI
- No
Blue Mantis does not process end-user PII, financial records, healthcare data, production database contents, or any data outside the software development workflow. It never reads repository secrets, environment variables, or GitHub Actions secrets.
Which models run.
What they see. What they never touch.
Blue Mantis is an AI orchestration layer, not an AI model. We use established model providers via their enterprise APIs. Here is exactly what runs and why.
| Agent | Model | Provider | Purpose | What it receives |
|---|---|---|---|---|
| Raptia | claude-sonnet-4-5 | Anthropic | Code generation | Work item + selected code files + stack profile |
| Fovea | gpt-4o | OpenAI | Code generation | Same case file as Raptia — run in parallel |
| Synthesia | claude-sonnet-4-5 | Anthropic | Ranking | Both suggestions + AC + stack profile |
| Veria | claude-sonnet-4-5 | Anthropic | Code review | Committed code + acceptance criteria |
| Aegis | claude-fable-5 | Anthropic | Security scanning | Committed file only — no other repo context |
Blue Mantis does not train any AI model. All inference calls are made via the Anthropic and OpenAI enterprise APIs. Under enterprise API terms, customer data is not used for model training — Anthropic's API offers zero-data-retention terms for enterprise customers.
Every API call is made using the customer’s own Anthropic and OpenAI API keys, stored per-user and never shared. You see the usage in your own Anthropic/OpenAI dashboards. Blue Mantis does not proxy or aggregate model costs.
If Blue Mantis changes the model used for any agent that affects code-generation output, customers receive 30 days’ written notice before the change takes effect. The model version used is recorded on every run record.
By default, no code is committed to your repository without explicit developer action. Blue Mantis presents two competing suggestions and a ranked recommendation; the developer chooses which to commit, then clicks. An optional per-run auto-commit setting — off by default — commits the top-ranked suggestion automatically only when you enable it. Blue Mantis never merges and never force-pushes.
Who can reach what,
and how it is enforced.
Email / password or OAuth via Clerk. MFA available (TOTP). MFA enforcement for the Enterprise plan: Q4 2026. Session management: Clerk-managed, with token expiry and refresh.
SSO / SAML 2.0 — Okta, Azure AD, Google Workspace. Target: Q4 2026.
Every API endpoint requires authentication. Every database query is scoped to the authenticated user’s ID. Team admins see team data; members see their own runs. No endpoint accepts a userId parameter from the request body — it is always derived server-side from the authenticated session.
// Every run query — representative example where: and( eq(runs.userId, req.userId), // always server-set eq(runs.projectId, projectId) )
Two named individuals (co-founders) have Supabase database access, protected by MFA. No other staff have database access. There is no Blue Mantis admin UI for viewing customer data. Supabase infrastructure access logs are maintained by Supabase (SOC 2 Type II certified).
Where every byte lives.
All primary storage and processing is in the United States. No data is transferred to or stored in EU regions.
| Component | Provider | Region | Certification | Data category |
|---|---|---|---|---|
| Application hosting | Vercel | US East (AWS/CF) | SOC 2 Type II | All application traffic |
| Database | Supabase | AWS us-east-1 | SOC 2 Type II | All stored data |
| Authentication | Clerk | US | SOC 2 Type II | User accounts + sessions |
| Resend | US | SOC 2 Type II | Run notifications | |
| Graphify microservice | Railway | US | — | Repository clone at index time (discarded) |
| AI inference (primary) | Anthropic | US | — | Code + work item content |
| AI inference (secondary) | OpenAI | US | SOC 2 Type II | Code + work item content |
The Graphify microservice clones the repository to a temporary directory, extracts the knowledge graph, and discards the checkout — it has no persistent storage. Blue Mantis stores only the resulting graph (file paths and symbol names), never file contents, and no code content is stored outside Supabase.
EU customers (future): EU data residency is on our roadmap for 2027. Customers requiring EU storage should contact us to discuss timeline.
Every significant action,
recorded. Admin-only.
The audit log records all of the following with timestamp, user ID, IP address, and relevant metadata:
- Who can access
- Team admins only
- Where
- Settings → Audit log
- Formats
- In-app filterable view + CSV export
- Filters
- Action type, team member, date range
Credential values are never logged — only key names. Audit rows are immutable. There is no delete or update endpoint for audit log entries.
Every third party
that touches your data.
Blue Mantis does not sell data to any third party. Sub-processors are used only to deliver the product.
| Name | Purpose | Data received | Location | Their certification |
|---|---|---|---|---|
| Supabase (PostgreSQL) | Database | Work items, runs, scores, credentials (encrypted at rest) | US East | SOC 2 Type II |
| Clerk | Authentication | Email, name, OAuth identity, session tokens | US | SOC 2 Type II |
| Anthropic | AI inference | Work item content + selected code file sections | US | Enterprise DPA available |
| OpenAI | AI inference | Work item content + selected code file sections | US | SOC 2 Type II · Enterprise DPA |
| Vercel | Application hosting | All application traffic (no persistent storage) | US | SOC 2 Type II |
| Resend | Email address + run outcome summary | US | SOC 2 Type II | |
| Railway | Graphify service | Repository clone at index time (no persistent storage) | US | — |
Credentials (Jira tokens, GitHub PATs, Azure DevOps tokens) are stored in Supabase only. They are never sent to Anthropic, OpenAI, Resend, Railway, or any other sub-processor.
Last updated: August 2026. We notify customers of material sub-processor changes with 30 days’ notice.
Questions about sub-processors or to request a copy of our DPA: security@getbluemantis.com
Where we are.
Where we are going.
We do not claim certifications we do not have. Here is the honest status of each compliance programme.
We have engaged a compliance automation platform and begun the readiness assessment. The observation period for Type II certification begins Q4 2026. Expected completion: mid-2027. Enterprise customers can request our current security controls documentation as a bridge.
An external penetration test of the Blue Mantis web application and API is scheduled for Q4 2026. We will publish the test scope, date, and findings summary upon completion.
Blue Mantis does not process California consumer personal data (end-user PII). Developer accounts are covered under our privacy policy. Blue Mantis operates as a service provider under CCPA — data is processed on your behalf, not for our own commercial purposes.
ISO 27001 certification is planned as part of our EU expansion programme. We will begin this process after SOC 2 Type II is complete.
Security questions, vulnerability reports, or to request our security controls documentation:
security@getbluemantis.comWe respond to security questions within 1 business day.
Found a vulnerability? Please disclose responsibly. We do not currently have a formal bug bounty programme, but we acknowledge and credit responsible disclosures.
To report a security vulnerability, email security@getbluemantis.com with details. Please do not disclose publicly until we have had 90 days to investigate and remediate.