Trust & security
Trust that meets your standards and proves it
What Soffi works with, and what stays with you
Soffi works with
- Code from the repos you grant
- Pull requests back to your repo
- A data twin of your APIs, auth, and data shapes
- Comments and changes from people you invite
Stays with you
- Production data and databases
- Backend services and secrets
- Identity providers
- Cloud accounts and infrastructure
Isolated by default, with no production access required
- Isolated by default. Every environment is walled off from other customers and from Soffi's internal systems.
- No production access. Soffi never needs production data, database access, or backend credentials.
- A data twin, not your prod data. Your app runs on realistic data that mirrors your APIs, auth, and data shapes.
Access stays in your hands
- Scoped to the repos you pick. Soffi connects through a GitHub app you install, with minimum permissions.
- Private by default. Previews are for the people you invite, and you set who can edit and who can comment.
- Revocable anytime. Uninstall the GitHub app to revoke access, and request deletion of your data anytime.
AI never ships on its own
- No training on your code. Nothing you bring to Soffi trains or fine-tunes any model, and our AI providers are bound by no-training terms.
- A person confirms every push. The agent can't push code or open a PR on its own.
- Your rules still apply. Every change is a PR through your existing review, CI, branch protections, and required reviewers.
Edit
Review
One for each repository the Workspace changed
Pull requestweb
Pull requestdesign system
Merged, then archived
- Your engineers review in GitHub and your CI runs
- Your team merges. Soffi never merges or deploys to production
- Once every pull request has merged, Soffi archives the Workspace
Compliance, audited and documented
SOC 2 Type II
Independently audited controls, with the report available under NDA.
Documented practices
How we control access, respond to incidents, recover from outages, and vet our vendors.
Everything in one place
The SOC 2 report, policies, and architecture overview your team needs to sign off, in our Trust Center.
Common questions
01Where does our code run?
In Soffi's cloud, never in yours. Each workspace runs in its own isolated environment, walled off from other customers and from our internal systems.
02Do you touch production?
No. Soffi doesn't require a connection to your database, backend services, identity provider, or cloud accounts.
03Do you need our env vars or secrets?
Not required. The data twin stands in for your backend. The only keys you might choose to add are for third-party services you want working live.
04Do you train on our code?
No. Nothing you bring to Soffi trains or fine-tunes any model.
05Can the AI ship on its own?
No. A person confirms every push, every change is a PR, and your engineers merge it.
06Who on our team can see our work?
By default, only the people you invite. You set who can edit and who can only comment.
07How do we remove access?
Uninstall the GitHub app to revoke access, and request deletion of your data anytime.
08Can we see your SOC 2 report and policies?
Yes. Request them through the Trust Center.
Give your whole team a safe way to build
Open your product, review a PR or start building something new. Try Soffi in a free sandbox or connect your repository and we'll help you get set up.
SOC 2 Type II audited · View our Trust Center