Skip to content
My Beast
Cart
Developer docsMenu

Deploys · Plans and data

Data and privacy

Deploys keeps what a deploy says about itself: who ran it, from where, the commit and its log. Your key, secrets on the command line and what you type at a prompt stay on your machine.

What Deploys keeps

Loading what it keeps…

What leaves your machine

When a deploy starts, mybeast-deploy sends:

  • the app, the environment, and the command as it is shown;
  • the commit, its subject, the branch, and for a deploy the last 50 commits with their authors' names;
  • git's user.name and user.email, the machine's name and the system user who ran it.

Then the command's output as it comes, and how it ended. Nothing else is sent: not your files, not your environment's variables, not your shell's history.

What is kept back

  • Your key. MYBEAST_DEPLOYS_KEY goes to curl on its standard input, never on a command line, and is taken out of the deploy command's environment.
  • Secrets on the command line. The value of anything whose name looks like a secret, such as DEPLOY_PASSWORD=… or --token=…, is taken out before the command is sent, and again by Deploys before it is kept. A name with PASSWORD, PASS, SECRET, TOKEN, KEY or CREDENTIAL in it, in any case, counts. A secret given as a word of its own, as in --token abc, is not found: pass secrets through the environment or a prompt.
  • What you type at a prompt. A deploy password or a “type production” goes from the terminal to your command, and never into the log.
  • Secrets in saved commands. An app's saved deploy or rollback command may hold none: Deploys refuses one that does.

The log

Keep secrets out of your script's output

The log is kept as your script prints it, for everyone who can open the project in Deploys, and the end of a failed one goes into its notices. A script that prints a password, a token or a connection string sends it to Deploys.

Colours and cursor codes are taken out of the log; nothing else is. A deploy's log is kept with its deploy.

Erasing a person's data

A deploy names a person by what git says on their machine: their name and e-mail address, the machine's name and their system user, and the commit authors' names. Deploys has no page that erases one person's deploys.

When someone asks you to erase their data, write to us at hello@my-beast.com with the project and what they asked for. We help you answer such requests, as our data processing terms say.