Xerg only reads
- Your repos: the Xerg GitHub App can only read. It can’t push code, open pull requests or change settings. See GitHub.
- Your accounts: every connector lists, describes and counts. Each connector’s page has the exact permissions or scopes it uses, and how to make the narrowest key the vendor offers.
- Ask and coding agents: their tools only read the map.
Secrets
- Xerg downloads example env files and keeps variable names, never values. It never downloads real
.envfiles. See What Xerg reads. - It downloads up to 300 source files per repo and scans them for imports and API hostnames. It keeps the service, the file and the line, never the code. An owner or admin can turn this off in setup.
- Connected keys and tokens are encrypted with AES-256-GCM, stored per workspace, used only on Xerg’s servers, and never sent to a browser. Disconnecting deletes them.
- Coding-agent keys are stored hashed, last 90 days and allow 600 calls an hour. Their maker or an admin can revoke them.
Who sees what
A workspace’s map and connections are visible to its people only, each with a role. Invites go to one email address and expire after 7 days.What’s stored
- The map: names of apps, services and resources, how they connect, and which file and line each came from. It also has the env variable names each app uses, and who owns what from
CODEOWNERS(GitHub handles and emails). File contents aren’t stored. - What connected accounts return: names, regions, status, counts and spend, user counts, Slack channel names, and the DNS targets that point at other services.
- History: a compact copy of each day’s map (its items’ names, kinds and statuses, and how they link) for 180 days, even after the map is cleared. See History.
- Accounts: your email, name, GitHub username and profile picture from your sign-in method, your sessions, the tokens Google or GitHub issue at sign-in (encrypted), your role and when you were last seen.
- In your browser: the last 30 Ask Xerg messages, in the tab’s session storage, until the tab is closed.
- Analytics: see below.
Analytics and cookies
xerg.ai and the app ask with a cookie banner (CookieYes). In the US, Analytics and Advertising are on until you turn them off; elsewhere they’re off until you turn them on. One choice covers the site and the app. Change it with Your privacy choices at the bottom of xerg.ai.- PostHog counts visits and pages. Unless you accept Analytics, it sets no cookies and keeps nothing in your browser. With Analytics, a cookie keeps an anonymous ID across xerg.ai and the app.
- In the app, once you sign in and have accepted Analytics, events carry your Xerg account’s ID and your workspace’s ID, never your email, name or GitHub username. They record steps such as installing the GitHub App, your first map, connecting an account and asking a question, never the question, your repos or what’s on your map. Page addresses are sent without their query string. No session recordings.
- Cardinal (run by RB2B) identifies business visitors to xerg.ai, only with Advertising allowed and never with Global Privacy Control on. It isn’t in the app.
Who processes data
- Vercel hosts Xerg and runs its servers.
- Neon hosts its Postgres database (workspaces, maps, encrypted connections).
- GitHub provides sign-in and repo access; Google provides sign-in if you choose it.
- Resend sends sign-in and invite emails.
- Anthropic runs the model behind Ask Xerg: it receives your question, the conversation’s earlier messages, the workspace’s name and what Ask looks up on the map.
- PostHog runs Xerg’s analytics; CookieYes shows the cookie banner and keeps your choice; Cardinal and RB2B identify business visitors to xerg.ai with Advertising allowed.
- Brandfetch and the Simple Icons CDN serve service logos to your browser.