Security

What compiler.dev does with your code and your jobs, in plain terms. Questions: contact@compiler.dev.

Isolation

• One machine per job. Each job runs in its own Firecracker microVM, or in a single-use cloud VM when we overflow to cloud capacity. It is destroyed after the job.
• No lateral movement. Machines cannot reach each other or our internal networks.
• Warm caches belong to you. Dependency, git and Docker caches are kept per customer, and are deleted when you leave. Pull requests can read the default branch's build cache but only write their own.
• No customer secrets in warm images. The images machines start from contain no customer secrets.

The GitHub App

You choose which repositories the compiler.dev GitHub App can see. GitHub shows the exact permission list on its install screen, and you can remove access at any time by uninstalling the App, which stops all access and routing immediately. In short, the App is used to:

• Read workflows and job metadata, to analyse which jobs can move and to show you runs, timings and costs.
• Register one-time runners for jobs routed to compiler.dev (or labelled compiler-8cpu and similar), so a job can run on our machines.
• Propose workflow changes only through the setup pull request. It never merges anything.

When you install it, choose “Only select repositories” and pick the repositories you want to speed up. Each permission and what it is for:

• Actions. Read workflow runs and jobs to show timings and results, and re-run failed jobs when you ask.
• Administration. Register one-time runners so a job can run on a compiler.dev machine. GitHub requires this permission for runner registration.
• Contents. Read your workflow files to find which jobs can move, and write the branch for the setup pull request.
• Deployments. We are confirming exactly what this is used for and will update this list.
• Pull requests. Open the setup pull request, which you review and merge yourself. We never merge anything.
• Workflows. Let the setup pull request change files under .github/workflows. GitHub blocks that without this permission.
• Commit statuses. We are confirming exactly what this is used for and will update this list.
• Metadata. Read-only basics (repository names and settings) that GitHub grants to every App.
• Email addresses. We are confirming exactly what this is used for and will update this list.

Secrets

Jobs that use secrets run on our machines with the secrets you grant them; prefer test-only credentials. Job logs may contain whatever your jobs print, so keep secrets out of logs. Job log excerpts shown through our Claude (MCP) integration have secrets redacted. Keys you give us, such as an Anthropic or OpenAI key, are stored encrypted, sent only where they are needed, and never shown again. Card details go directly to Stripe and never reach us.

Where jobs run

Jobs run on our dedicated servers in Finland (Hetzner). When those are full, jobs overflow to single-use cloud machines, normally Hetzner Cloud in Germany or Finland; some overflow capacity is on AWS in London (eu-west-2) and US East (us-east-1). Need EU-only? Email contact@compiler.dev.

Sub-processors and retention

The services that process data for us are listed in the privacy policy, together with how long each kind of data is kept. Job logs and product events are kept for two years; caches expire automatically; Code in a box disks are kept until you delete the box.

Contact and assurance

Report a vulnerability or ask a security question at contact@compiler.dev.

SOC 2: not yet. Security questionnaire on request.

compiler.dev is operated by LUXLOGIK LTD, registered in England and Wales, company number 14433322. See also Terms and Status.