Security & privacy
Trust is the product.
Giving a co-pilot access to your code, your users’ behavior and your AI keys is a serious decision. Here is exactly how ROOKON is designed to deserve it.
AI provider credentials
You own the key
You connect your own OpenAI, Anthropic or Google key and can rotate or revoke it at any time.
Envelope encryption
Each secret is encrypted with its own data key (AES-256-GCM); data keys are encrypted with a master key kept outside the database.
Never exposed
Keys are never sent to browsers, written to logs or returned by the API after you save them. You only see a masked hint.
Minimal context
Only the evidence needed for an analysis is sent to your provider, with personal data and secrets removed first.
GitHub and code changes
Least privilege
Read access to the repositories you choose. Write access is opt-in and used only to push ROOKON’s own branches.
Pull requests only
ROOKON can open a pull request. It never merges on its own, never deploys and never pushes to protected branches.
Your rules apply
Branch protection, required reviews and CI checks apply to ROOKON like any other contributor.
Explained and tested
Every pull request explains what changed and why, linked to the evidence. Code fixes come with tests, and Merge needs them to pass.
Data protection
Tenant isolation
Every record is scoped to its organization, and the data layer refuses queries without that scope.
Role-based access
Owners, admins, developers and viewers get only the permissions their role needs.
Audit logs
Sensitive actions (credential changes, approvals, deletions) are recorded with who did what and when.
Encrypted in transit
All traffic between your app, ROOKON and integrations uses TLS.
Privacy and GDPR
Data minimization
ROOKON collects what it needs to find problems, not everything it could.
Retention controls
Choose how long events and recordings are kept; expired data is deleted automatically.
Deletion workflows
Delete data for a single end-user or a whole project on request.
Consent-aware
The tracker can wait for your site’s consent signal and honors Do Not Track and Global Privacy Control.
Live demo 1 of 3
See exactly what a recording contains
Type into the form and change the rules. Masking happens before anything leaves the browser; passwords are never recorded.
- Turn off “Mask all inputs”
- Exclude the /checkout path
rookon · project settings · privacy
Simulated dataRecording rules
What ROOKON records
- Full name
- ••••••••••••
- Work email
- •••••••••••••••••
- Password
- [never recorded]
- Card number
- [element blocked]
- Company
- •••••••••••
Masking happens in the visitor’s browser, before anything is sent. Passwords are never recorded under any setting.
48,210 inputs masked today3,904 payment/password fields never recordedLive
Live demo 2 of 3
Watch an AI key get envelope-encrypted
Real Web Crypto in your browser: a fresh data key encrypts a sample key with AES-256-GCM, a master key wraps the data key, and only ciphertext plus a masked hint remain. Nothing is sent anywhere.
- Use the sample key
- Inspect the stored record
- Revoke it
rookon · settings · AI provider · Anthropic Claude
Simulated dataConnect Anthropic ClaudeIn development
Don’t paste a real key. This demo runs only in your browser and sends nothing. Use the sample key instead.
Envelope encryption
When you save a key:
- a fresh data key encrypts it (AES-256-GCM),
- a master key that never touches the database wraps the data key,
- only ciphertext and a masked hint are stored,
- the worker decrypts it for a single analysis request, then forgets it.
The API returns only maskedKey after saving, never the key itself, to anyone.
Live demo 3 of 3
Every GitHub permission, before you grant it
Simulated GitHub App installation: read-only by default, opt-in write limited to ROOKON’s own branches, and your branch protection still applies.
github.com · install ROOKON on acme
Simulated dataRepository access
LiveIntegration: In developmentPermissions GitHub will show you
| Metadata | Read | List the repositories you selected (required by GitHub). |
| Contents | Read | Read the code relevant to an issue. |
ROOKON can
- Read code in 1 selected repository
ROOKON cannot
- Merge pull requests or deploy
- Push to main or any protected branch
- Change repository settings, secrets or workflows
- Access repositories you didn’t select
- Write anything at all (read-only mode)
Try it
Try: Toggle “Propose fixes as pull requests” · Try to push to main
FAQ
Security questions
Where are my AI provider keys stored?
Keys are stored encrypted with envelope encryption: each key has its own data key, which is encrypted with a master key kept outside the database. They are decrypted only in the background worker at the moment of a request, never returned by the API after saving and never written to logs.
Can ROOKON change my production code?
No. ROOKON can open a pull request on its own branch after you authorize it. It never merges on its own: you accept the change first, and a merge only happens when a person taps Merge (or merges in GitHub). Your branch protection rules apply to its pull requests like any other contributor's.
How is session replay kept private?
Masking runs in the visitor's browser, so protected content never leaves the device. All inputs are masked by default, password and payment fields are never recorded, and you can add selectors to mask or block elements and paths to exclude.
How do retention and deletion work?
You set how long events and recordings are kept. Data past its retention period is deleted automatically, and you can delete all data for a specific user or an entire project on request.
Stop managing every detail. Start building a better product.
ROOKON watches your product, explains what’s wrong and prepares the fix. You decide what ships.