---
title: Security
description: Mergify's security posture — compliance, data handling, access control, and the GitHub App permissions we request.
---

Mergify runs in front of GitHub to evaluate merge conditions and orchestrate
your pipeline. This page documents our compliance posture, how we handle your
data, the access controls in place, and the GitHub App permissions we request.

## Compliance

Mergify is **SOC 2 Type II** attested. Reports, audit details, and our
sub-processor list are available in the Trust Center.

<Button href="https://trust.mergify.com" colorScheme='blue'>
  Trust Center
</Button>

A Data Processing Addendum (DPA) is available on request. Contact <a
  href="mailto:security@mergify.com">security@mergify.com</a>.

## Data Handling

:::tip
  Mergify processes repository contents in memory and does not persist them.
:::

- **Encryption in transit:** TLS 1.2 or higher.

- **Encryption at rest:** persisted service data, such as configuration and
  metadata, is encrypted with AES-256.

- **Service status:** real-time availability and incident history at
  [status.mergify.com](https://status.mergify.com).

## Access Control

Mergify does not maintain a separate identity or permission system. All
authentication and authorization are delegated to GitHub:

- **Single sign-on:** users sign in through GitHub, so any SSO policy you
  enforce on your GitHub organization (including SAML SSO) applies to
  Mergify.

- **Roles and permissions:** Mergify users inherit their roles directly from
  [GitHub
  roles](https://docs.github.com/en/organizations/managing-user-access-to-your-organizations-repositories/managing-repository-roles/repository-roles-for-an-organization).
  A user with the `Read` role on a repository in GitHub also has the `Read`
  role in Mergify.

Some operations additionally require the GitHub organization `Owner` role.
See the [Features Permissions](#features-permissions) table below for the
full mapping between GitHub roles and Mergify capabilities.

## Vulnerability Disclosure

Mergify hosts a public Bug Bounty program with HackerOne. If you believe
you've found a security issue on our platform, please disclose it responsibly.

<Button href="https://hackerone.com/mergify" colorScheme='blue'>
  Submit a vulnerability
</Button>

For other security questions or concerns, contact our security team at <a
  href="mailto:security@mergify.com">security@mergify.com</a>.

## Reference

Mergify requests a fixed set of GitHub App permissions required for the
product to operate. Some permissions are only exercised by specific features.

### GitHub App Required Permissions

Below is the list of the required permissions on GitHub for Mergify to
function properly.

<table>
  <thead>
    <tr>
      <th>Permission</th>
      <th>Access</th>
      <th>Usage</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>Repository: Actions</td>
      <td>Read-only</td>
      <td>Used to read workflow details.</td>
    </tr>
    <tr>
      <td>Repository: Administration</td>
      <td>Read-only</td>
      <td>Used to access team details.</td>
    </tr>
    <tr>
      <td>Repository: Checks</td>
      <td>Read and write</td>
      <td>Used to read and post checks.</td>
    </tr>
    <tr>
      <td>Repository: Commit statuses</td>
      <td>Read-only</td>
      <td>Used to read checks status.</td>
    </tr>
    <tr>
      <td>Repository: Contents</td>
      <td>Read and write</td>
      <td>Used to read repository content and write (merge).</td>
    </tr>
    <tr>
      <td>Repository: Deployments</td>
      <td>Read and write</td>
      <td>Used to read and post deployments status.</td>
    </tr>
    <tr>
      <td>Repository: Issues</td>
      <td>Read and write</td>
      <td>Used to close issues on merge.</td>
    </tr>
    <tr>
      <td>Repository: Metadata</td>
      <td>Read-only</td>
      <td>Access repository metadata.</td>
    </tr>
    <tr>
      <td>Repository: Merge queues</td>
      <td>Read-only</td>
      <td>Used to receive GitHub merge queues events.</td>
    </tr>
    <tr>
      <td>Repository: Pages</td>
      <td>Read and write</td>
      <td>Write required to trigger page workflow on merge.</td>
    </tr>
    <tr>
      <td>Repository: Pull requests</td>
      <td>Read and write</td>
      <td>Used to read and edit pull requests.</td>
    </tr>
    <tr>
      <td>Repository: Workflows</td>
      <td>Read and write</td>
      <td>Used to read workflows and merge pull requests modifying workflows.</td>
    </tr>
    <tr>
      <td>Organization: Members</td>
      <td>Read-only</td>
      <td>Used to list organization members.</td>
    </tr>
    <tr>
      <td>Account: Email addresses</td>
      <td>Read-only</td>
      <td>Used to read user email addresses.</td>
    </tr>
  </tbody>
</table>

### Features Permissions

To perform any action on Mergify (such as adding a pull request to a merge
queue or triggering a command), a user must have sufficient access to the
relevant account or resource. Permissions are inherited from GitHub roles.

<table>
  <thead>
    <tr>
      <th rowSpan="2">Feature</th>
      <th colSpan="5">Repository role</th>
      <th>Organization role</th>
    </tr>
    <tr>
      <th>Read</th>
      <th>Triage</th>
      <th>Write</th>
      <th>Maintain</th>
      <th>Admin</th>
      <th>Owner</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <th colSpan="7" scope="rowgroup">Merge Queue</th>
    </tr>
    <tr>
      <td>View the merge queue</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Pause the merge queue</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
  </tbody>
  <tbody>
    <tr>
      <th colSpan="7" scope="rowgroup">Merge Protection</th>
    </tr>
    <tr>
      <td>View merge protection status</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Edit merge protection rules in <code>.mergify.yml</code></td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Schedule a queue freeze</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
  </tbody>
  <tbody>
    <tr>
      <th colSpan="7" scope="rowgroup">CI Insights</th>
    </tr>
    <tr>
      <td>View CI Insights data</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Activate CI Insights or configure its repositories</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Manage CI Insights Auto-Retry rules</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Configure CI Insights self-hosted runners</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
    </tr>
  </tbody>
  <tbody>
    <tr>
      <th colSpan="7" scope="rowgroup">Test Insights</th>
    </tr>
    <tr>
      <td>View Test Insights data</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Quarantine or unquarantine tests</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Configure Test Insights Auto-Quarantine</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
      <td>✓</td>
    </tr>
  </tbody>
  <tbody>
    <tr>
      <th colSpan="7" scope="rowgroup">Account</th>
    </tr>
    <tr>
      <td>Manage API keys</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
    </tr>
    <tr>
      <td>Manage Mergify subscription</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✗</td>
      <td>✓</td>
    </tr>
  </tbody>
</table>

:::note
  Non-admin users can be granted access to manage Mergify subscription and
  billing details on demand. <a href="mailto:support@mergify.com">Contact
  support</a> to request it.
:::

### Command Permissions

[Mergify commands](/commands) are [restricted by
default](/commands/restrictions/#default-restrictions) and have their own
mechanism that can be modified. See [Commands
Restrictions](/commands/restrictions/) for changing the default.

## Managing IP Addresses Allowed for the GitHub App

[GitHub allows you to configure the list of IP
addresses](https://docs.github.com/en/apps/maintaining-github-apps/managing-allowed-ip-addresses-for-a-github-app)
that a GitHub App is allowed to use to access GitHub.

Mergify services use the following IP addresses:

- 34.121.26.35/32
- 34.45.103.142/32
- 34.69.118.185/32
- 136.119.26.243/32

:::note
  Even though these IP addresses appear in the GitHub allow list as "Managed
  by Mergify GitHub App", they must be manually added to the list by an
  organization administrator. GitHub does not allow OAuth authentication to
  our dashboard if these IPs have not been manually added.
:::