Countersign

Data-handling contract

Send the config. Keep the secrets out. Get the verdict. Then the config disappears.

Countersign reviews CI/CD configuration without turning it into training data, a reusable corpus, or a support artifact that lingers after the work is done.

Handling path

What happens to a submitted config

Paste-only intake

You paste the CI/CD configuration needed for review. Secret detection blocks likely tokens before storage; the review is designed around redacted config, not credential collection.

Encrypted at rest

Stored submissions are encrypted with libsodium secretbox. The encryption key is held outside the public web path, separate from the served site files.

Single-operator review

Submitted config is reviewed by the Countersign operator for your verdict. It is not routed to subcontracted reviewers, analytics tools, or model vendors.

Local page assets

This page loads only self-hosted CSS, fonts, and JavaScript from the Countersign origin. There are no third-party font hosts, analytics beacons, or embedded tracking scripts on the trust page.

Never do

What Countersign does not do with your config

Submitted config is never absorbed into a product dataset.

Submitted config is never trained on or used for model improvement.

Submitted config is never shared, resold, published, or turned into a sample without explicit de-identification approval.

Submitted config is never emailed back to you; notices and receipts are metadata-only.

Retention and deletion

Hard-deleted after the first deadline hits.

Submitted config is hard-deleted at the earlier of 14 days after submission or 7 days after verdict delivery.

The signed verdict remains your deliverable. The submitted config does not become durable customer history, marketing material, or a future reference file.

Receipt sample

Deletion receipts are metadata-only

The receipt confirms the deletion event without including submitted config, secrets, or reviewed content. 

Subject: Countersign deletion receipt
Job: cs_job_8fd4c2
Deleted item: submitted CI/CD configuration
Deleted at: 2026-06-19T03:00:00Z
Retention rule: earlier of 14 days from submission or 7 days post-verdict
Signed verdict retained: yes
Config content included: no
Secrets included: no

Before you paste

How to redact safely

  • Replace tokens, passwords, private keys, account IDs, and webhook secrets with labels like REDACTED_TOKEN.
  • Keep command names, job names, permissions, trigger rules, and dependency versions visible so the review can stay useful.
  • Leave structural risk signals in place: branch filters, environment gates, third-party actions, cache keys, and publish steps.
  • If secret detection blocks the intake, remove the flagged value and submit again with the same shape preserved.

NDA / vendor sign-off

Procurement can review the same boundaries.

The vendor sign-off and optional mutual NDA are freely downloadable static artifacts. They restate the same operating limits: paste-only intake, encrypted storage, key outside the public web path, no review sub-processors for submitted configs, no model training, and deletion by the published retention window.

Download Vendor sign-off summary One-page artifact for a security reviewer who never visits this site. Download Optional mutual NDA Static review artifact for organizations that need an NDA before sending redacted config.
Your config is reviewed, then erased: never absorbed, never trained on, never shared.
Countersign operating promise