Where we are today
Releo is pre-launch. The only data we hold today is the information people submit to our waitlist. We are not yet independently certified (for example, SOC 2), and we will not claim to be. Before any design partner connects production traffic, we will publish the controls that apply to it.
Waitlist data
- What we store: your email address, the role you optionally select, the page you signed up from, a country code derived from the request, and a timestamp.
- What we do not store: your IP address. For abuse prevention we keep a one-way hash of it, salted with the current date, for no more than a day.
- Where: Cloudflare D1, behind Cloudflare’s network. Data is encrypted in transit with TLS and at rest by the provider.
- Who can see it: only the Releo team, through an endpoint protected by a secret token.
- No trackers: the site sets no cookies, loads no advertising or analytics scripts, and serves its fonts itself.
You can ask us to delete your entry at any time; see Privacy.
How the product is designed to handle your code and traffic
These are the design principles the beta is being built against. They will be backed by published controls before production data is involved.
- Least privilege. Repository access is scoped to the repositories you select, with the minimum permissions needed to read code and open pull requests.
- Review stays human. Releo proposes changes as pull requests and never pushes to protected branches.
- Redact before storing. Secrets and personal data are redacted from captured traffic before it is stored for replay.
- Isolated replay. Replay runs against isolated environments, never against production systems of record, so replayed requests cannot cause real side effects.
- Minimal retention. Captured traffic is kept only as long as verification needs it.
- Run it yourself. Enterprise customers will be able to run replay workers inside their own infrastructure, so traffic never leaves their network.
Reporting a vulnerability
If you believe you have found a security issue in anything Releo runs, email security@tryreleo.com. Please include steps to reproduce and give us reasonable time to respond before disclosing publicly.
We will acknowledge reports promptly, keep you informed, and credit you if you wish. We will not pursue legal action against good-faith research that avoids privacy violations, data destruction and service disruption.
Our machine-readable contact details are published at /.well-known/security.txt.