what porcelain stores, where, and how to delete it
Short version: GitHub stays the source of record. Porcelain keeps a synced copy of repo metadata so agents can fetch it as git refs. Delete a repo and the copy is gone.
what we store
- issues, PRs, reviews, comments — synced via webhooks into Postgres (EU, Ireland), one schema per product, bitemporal rows
- overlay files — the same data materialized as git objects in Cloudflare R2 (EU jurisdiction)
- access logs — who fetched/pushed what, when, status codes, latency. no request bodies
- repo code is NOT stored for passthrough clones — code packs stream from GitHub through the proxy to you
tokens
- porcelain tokens: we store only sha256 hashes. a leaked database cannot reproduce your token
- GitHub PATs you contribute to a pool: secret values live in Cloudflare KV, only token prefixes and health metadata in Postgres
- webhook payloads are HMAC-verified (sha256) before anything is written
deletion
- disconnect a repo and its rows, overlay objects, and webhook registrations are removed
- email security@porcelain.sh for full account deletion or security reports