Back to Fireweave

Fireweave

Privacy

Last updated: September 19, 2026

This notice covers two things. First, information submitted through this website (fireweave.ai) — demo requests, onboarding surveys, and optional product analytics. Second, information the Fireweave product handles once you connect it to your systems, including the Fireweave AI GitHub App.

Information We Receive

If you contact us, request a demo, or complete onboarding, we receive the details you choose to send — for example name, work email, company, website, role, team size, stack choices, and free-text notes. We may also receive UTM parameters from the URL when you submit a form.

How We Use It

We use submitted information to respond to inquiries, schedule demos, tailor onboarding, and improve how we explain Fireweave. We do not sell personal information.

Cookies and Local Storage

When analytics are enabled, PostHog may set cookies or use local storage to recognize a browser session and measure page views. Demo → onboarding handoff may use sessionStorage on your device to prefill contact fields; that data stays in your browser until the onboarding form is submitted or the tab session ends.

The Fireweave GitHub App

When someone installs the Fireweave AI GitHub App, we receive the installation, the account it was installed on, and the repositories the installer selected. We store the GitHub installation ID so we can act on that installation later.

The app subscribes to pull request events, check runs on checks we created, installation and repository-selection changes, and GitHub's initial ping. From a pull request event we read the repository name, the pull request number, the head and base branch names, the head, base, and merge commit SHAs, and the installation ID. We do not read the pull request title, body, or author.

Repository Access

The app can only reach the repositories the installer selects — GitHub enforces that, not us. To read a repository we exchange the installation for an access token that GitHub scopes to those repositories and expires after one hour. When we clone, that token is passed to the clone command in its environment and the remote URL is stripped of it before the command returns, so no credential is left on disk.

Your Source Code

To evaluate a pull request, Fireweave clones the commit into a container it creates for that one run. That container runs on Fireweave's infrastructure, not yours. Your source code therefore leaves your environment for the duration of the check.

The container is single-purpose and network-restricted: outbound traffic is denied by default and allowed only to GitHub, plus Fireweave's own model relay when the analysis described below is turned on. When the run finishes we destroy the container. The container also carries a hard expiry, so it is destroyed even if a run never reports back. The clone exists inside that container and does not outlive it.

We do not copy your source code, file contents, or diffs into a database, an object store, or our logs.

What We Store From a Pull Request

We keep a record of each check we run. It holds:

  • the repository name, pull request number, and the base and head commit SHAs
  • the ID and state of the check run we posted
  • the readiness verdict and how many files changed
  • the control points the change touches — their keys, declared defaults, descriptions, and the file paths and line numbers where they are anchored
  • findings, each with a rule, a message, and where applicable a file path and line

Where a change starts a rollout, we also store the repository, branch, commit SHA, and pull request number against that rollout. File paths, line numbers, and control-point descriptions are taken from your repository. The change itself — the diff and the file contents — is not stored.

AI Analysis of Your Code

Fireweave can run an additional, advisory analysis of a pull request using a large language model. It is off by default for every project, and turning it on requires a project owner or admin to acknowledge that code leaves your environment. We record who acknowledged it and when.

When it is on, an agent runs inside the same single-run container with read-only access to the checkout — it can read, search, and list files, and it cannot write to them. Its model requests are forwarded by Fireweave to Anthropic's API. Your diff and the file contents the agent reads are part of those requests. The agent's answer is stored on the check record as structured data: a risk score, a written summary of the change, reasons with file and line references, affected services, and the token counts and cost of the run.

What Fireweave Does Not Do

  • We do not push commits, open pull requests, or edit files in your repositories.
  • We do not run inside your CI or trigger your workflows.
  • The only things we write to GitHub are a check run named FireWeave — rollout readiness and a single advisory pull request comment, edited in place on each run rather than reposted.

Learning Across Rollouts

Fireweave uses the history of your past rollouts to inform later ones. That history is the outcome of a rollout — whether it shipped or rolled back, how long the ramp took, and the recorded reason — and it is read only within the project it belongs to. It does not include your source code or pull request content, and it is not pooled or shared across organizations.

Subprocessors

We use the following processors for this website, depending on which features are enabled:

  • HubSpot — CRM storage of demo / lead form submissions
  • Calendly — optional demo scheduling when embedded booking is enabled
  • Resend — optional email notification of leads to Fireweave
  • PostHog — optional product analytics and feature-flag evaluation

For the product and the GitHub App:

  • GitHub — the source of the installation, events, and repository
  • Amazon Web Services — the infrastructure Fireweave runs on, including the containers that hold a checkout during a run
  • Anthropic — the model provider for the AI analysis above, and only when a project has turned that analysis on

Each processor handles data under its own privacy terms and our instructions.

Where Processing Happens

Fireweave's own services, including the containers that hold a checkout during a run, run on AWS in the United States (us-east-1).

Retention

Lead and CRM records are retained while we have an active business reason to respond to or follow up on your inquiry, and thereafter as needed for legitimate interests or legal obligations. Analytics events are retained according to our PostHog project settings.

Check records, control points, and rollout history are retained for as long as your organization uses Fireweave, so that the history stays readable. A checkout is not retained: it exists only inside the container for that run. You can request deletion as described below.

Uninstalling the GitHub App

Uninstalling removes our access immediately — GitHub stops delivering events and stops issuing tokens for the installation, so we can no longer read your repositories. It does not, by itself, delete what we already stored. The connection is marked revoked once we next try to use it, and the check records, control points, and rollout history from earlier runs remain until deleted. To have them deleted, email contact@fireweave.ai and say which organization or repositories to remove.

Your Rights

Depending on your location, you may have rights to access, correct, or delete personal information we hold, or to object to certain processing. Contact us at contact@fireweave.ai for privacy questions or deletion requests. We will respond within a reasonable period.

International Transfers

Our processors may process data in the United States or other countries. Where required, we rely on appropriate transfer mechanisms offered by those providers.

Contact

Privacy questions or deletion requests: contact@fireweave.ai.