GitHub App Transparency Disclosure¶
Signed Off — Last updated: June 20, 2026
Signed Off requests only the permissions required to function. No permission is held speculatively or for future use.
Permissions¶
| Permission | Access | Why |
|---|---|---|
| Issues | Read + Write | Post and update checklist comments; enforce closure rules; reopen issues in Block mode |
| Organization members | Read | Validate exception approvals — confirms approver is a different user and belongs to the configured approvers team |
| Repository contents | Read | Load checklist templates from .github and .github-private; read app configuration JSON. Source code is never accessed. |
| Metadata | Read | Required by GitHub for all Apps; used for repository routing and org-level config |
Webhook Events¶
| Event | Reason |
|---|---|
issues.opened |
Post checklist on new issue |
issues.edited |
Detect type change; update checklist |
issues.closed |
Trigger closure enforcement |
issues.reopened |
Reset enforcement state |
issue_comment.created |
Detect item updates, exceptions, and approvals |
Webhook payloads are processed in real time and are not stored.
Data Storage¶
Signed Off has no external database. All checklist state is stored inside GitHub issue comments within your repository. Data never leaves GitHub's infrastructure. GitHub's data residency and security guarantees apply in full.
Data Sharing¶
GitHub data is not shared with any third party. The only external service involved is Cloudflare Workers, used solely to serve the SVG progress badge. Cloudflare receives a badge request URL and caches the rendered SVG response for 60 seconds. No issue content, user identity, or personal data is transmitted to or stored by Cloudflare.
Uninstall¶
Uninstalling Signed Off immediately revokes all access. No external data cleanup is required because no data is stored outside GitHub.
Contact¶
For privacy enquiries: [email protected]
Full details: Privacy Policy