---
title: "Privacy at 9apes - Data Handling for GitHub Actions Runners"
description: "What data 9apes handles when you run GitHub Actions jobs: website analytics, GitHub authentication, requested App permissions, job isolation, cache storage, and the services involved."
url: https://9apes.com/privacy/
---

# Privacy at 9apes - Data Handling for GitHub Actions Runners

This page describes how 9apes handles data across the marketing site, the dashboard, and the runner service, based on how the system is built today.

_Last updated 2026-08-23._

## What this covers

This page covers 9apes.com including the documentation, the 9apes dashboard at build.9apes.com, and the runners that execute your GitHub Actions jobs.

It describes current practice. If you need a formal data processing agreement, a completed security questionnaire, or answers about a specific regulation, email support@9apes.com and the team will respond directly.

## This website

9apes.com loads PostHog product analytics to understand how visitors move through the marketing pages and documentation. This records interaction data such as pages viewed and actions taken on the site.

The marketing site does not ask for an account. Reading the docs, the runner labels, and the pricing requires no sign-in and sets no login state.

## Signing in

Login to 9apes is exclusively through GitHub SSO. 9apes does not operate a separate password for your account, which means there is no 9apes-held password to breach.

Connecting an organization installs the 9apes GitHub App. You choose which organization and which repositories that installation covers, and you can change or remove it from GitHub at any time.

## GitHub App permissions and why each is requested

- **Read access to members and metadata** — To list users in the 9apes settings page.

- **Read and write access to actions, code, pull requests, and workflows** — So the migration wizard can open a pull request containing the required workflow changes.

- **Read and write access to organization self-hosted runners** — To generate just-in-time tokens and let managed 9apes runners pick up your jobs.

## Your code during a job

Each job runs inside an ephemeral Firecracker microVM on bare metal, behind a private VPN. When the job finishes, the microVM is destroyed along with all of its state, and jobs never share a kernel.

Each job receives a just-in-time token scoped to that job which expires after one hour. The GitHub integration has no ability to directly access organization or repository level secrets. GitHub forwards job requests to 9apes; 9apes does not initiate access to your repositories.

## Build caches

Artifacts cached between jobs are stored on Cloudflare R2, co-located on the same bare-metal fleet as the runners. Access to cached data is authenticated and audited, and data is encrypted and isolated by organization.

## Services involved

- **GitHub** — Authentication, the App installation, and the workflow jobs that 9apes runs on your behalf.

- **Cloudflare** — R2 object storage for build caches, and delivery of 9apes.com.

- **PostHog** — Product analytics on 9apes.com.

## Questions and requests

For any question about data 9apes holds, including access and deletion requests, email support@9apes.com. To stop all 9apes processing immediately, uninstall the 9apes GitHub App from your organization in GitHub; that revokes the access described above.