# Security and data

The [EkLine Trust Center](https://ekline.io/trust-center) is the source of record for EkLine's compliance status and subprocessors, which can change. Check it for the current details.

## What EkLine accesses

EkLine only accesses the repositories and tools you connect, with the permissions you grant.

- **GitHub.** EkLine can see repositories only in GitHub accounts where the EkLine GitHub App is installed. When you install it, GitHub's install screen lists the permissions the app requests and lets you give it all repositories or only the ones you select. See [Connect GitHub](/agent/github-app-setup/).
- **GitLab.** EkLine uses an access token you create in GitLab, with the `api` and `read_repository` scopes. See [Connect GitLab](/agent/gitlab-setup/).
- **Other tools**, such as Slack, Jira, Linear, Notion, Confluence and Google Drive. You connect each one under **Settings** > **Integrations**, and the connection belongs to your organization rather than to one person. See [Integrations](/agent/integrations/).

## What EkLine changes

EkLine opens pull requests and drafts, and nothing merges or publishes without your approval.

In the **GitHub Integration** and **GitLab Integration** settings, you sort your repositories into two lists:

| List | Badge | What EkLine does there |
| --- | --- | --- |
| **Where EkLine writes** | **Write access** | Opens pull requests (merge requests on GitLab). Pick the repositories that hold your documentation. |
| **What else EkLine can read** | **Read-only** | Reads them to work out what changed and why. It never writes to them. Pick the repositories where product changes land. |

Your team reviews and merges each pull request in GitHub or GitLab, as with any other contributor. A request in Slack can open the pull request without a click in EkLine; merging is still your team's decision. See [How EkLine opens pull requests](/agent/how-ekline-opens-pull-requests/).

Marketing Agent drafts stay in EkLine for you to copy or download. The Marketing Agent publishes only when you ask it to and say where.

## How agent runs use credentials

Agent runs are sandboxed with scoped credentials. An agent works only through the repositories and tools your organization connected.

You also manage two kinds of keys yourself:

| Key | Where | Acts as |
| --- | --- | --- |
| Organization EkLine token | **Settings** > **Organization** > **Access** | Your organization. You add it as `EK_TOKEN` when you set up the Docs Reviewer. |
| Personal API key | **Settings** > **Profile** > **Personal API keys** | You, in one organization. EkLine shows the key only once, when you create it. Click **Revoke** to turn it off. |

A personal API key stops working in an organization when its owner is removed from it. See [Members and roles](/workspace/members-and-roles/).

## How your data is used

Your data is never used to train models.

The trust center lists the subprocessors EkLine uses to deliver its services, with the location of each.

## Compliance

EkLine is SOC 2 Type 2 compliant. See the [trust center](https://ekline.io/trust-center). For security questions the trust center does not answer, email support@ekline.io.

## FAQ

### Is EkLine SOC 2 compliant?

Yes. EkLine is SOC 2 Type 2 compliant. The [trust center](https://ekline.io/trust-center) shows the current status.

### Can EkLine change the code in our repositories?

EkLine never writes to repositories under **What else EkLine can read**: it reads them to work out what changed and why. It opens pull requests only in repositories under **Where EkLine writes**, and your team decides whether to merge them. On a pull request in any connected repository, EkLine can post comments, for example when someone mentions it. See [For engineers](/agent/for-engineers/).

### Is our data used to train AI models?

No. Your data is never used to train models.

### Which subprocessors does EkLine use?

The [trust center](https://ekline.io/trust-center) lists them, with the location of each.

### How do we remove EkLine's access?

- Click **Disconnect** on each tool under **Settings** > **Integrations**.
- Uninstall the EkLine GitHub App in your GitHub account or organization settings.
- For GitLab, click **Remove Token** under **Settings** > **Integrations** > **GitLab Integration**, and revoke the token in GitLab.
- Click **Revoke** on each personal API key under **Settings** > **Profile** > **Personal API keys**.