Security Overview

Toast Ninja Inc.
Last reviewed: June 2026
Contact: support@toast.ninja

What Toast Does

Toast is a GitHub and Slack integration that delivers pull request notifications and team activity summaries to Slack. It listens to GitHub webhook events, processes metadata about pull request activity, and sends formatted messages to Slack channels and users.

Toast does not provide code hosting, code execution, file storage, or any service that requires access to the contents of your repositories.

What Data Toast Accesses

What we access

When you install Toast, you authorize it through GitHub's and Slack's standard OAuth flows. Through those authorizations, Toast accesses:

• From GitHub: Pull request titles, PR numbers, open/closed/merged status, review states (approved, changes requested, commented), reviewer assignments, author names, usernames, and profile photos. Organization name, team names, and member lists.
• From Slack: Workspace name, channel IDs, and user IDs sufficient to deliver notifications to the right channels and people. Toast receives messages you explicitly send to it: slash commands (such as /toast), button interactions within Toast messages, and content you provide when using Toast to post a comment to GitHub on your behalf.
• Account information: Names, usernames, and email addresses from GitHub and Slack OAuth, used to associate your Toast configuration with your account.
• Billing: Your organization's subscription plan and Stripe customer ID. We do not handle or store payment card numbers.

What we do not access

• Source code. Toast does not request, receive, or store the contents of any file in any repository. The GitHub App permissions we request explicitly exclude repository contents.
• Issue or PR body text. We process the existence and state of pull requests, not their descriptions or comment bodies.
• Slack message history. We do not read messages in channels or conversations where Toast has not been explicitly addressed.
• Credentials or secrets. We never see GitHub personal access tokens, SSH keys, CI/CD secrets, or any secrets stored in your repositories or CI environment.

This access model is intentional and architectural. Because Toast operates on metadata rather than content, a compromise of Toast's systems would not expose your source code, your intellectual property, or sensitive information that might be present in code or issue descriptions.

Infrastructure and Hosting

Toast's production infrastructure runs entirely on cloud services operated by established, compliance-certified providers. Toast does not operate any physical servers, data centers, or networking equipment.

All production data is stored and processed in the United States.

Authentication and Access Control

User authentication is handled entirely through OAuth 2.0 via GitHub and Slack. Toast does not implement its own username and password system and does not store user passwords.

GitHub App installation grants scoped, revocable API access. Customers can revoke Toast's access at any time from GitHub's organization settings, which immediately terminates all API access. Slack App installation uses OAuth 2.0 workspace authorization and can similarly be revoked at any time.

All inbound webhooks from GitHub and Slack are verified using HMAC signature validation before processing. Stripe webhook payloads are verified using Stripe's webhook signature scheme.

Data Security

• Encryption in transit: All communication between Toast and external services uses TLS 1.2 or higher. Webhooks are received over HTTPS only.
• Encryption at rest: Heroku Postgres encrypts data at rest on the underlying AWS EBS volumes using AES-256.
• OAuth token storage: GitHub and Slack OAuth tokens are stored in the production database. They are not logged or included in error reports.
• Secrets management: API keys and signing secrets are stored as environment variables in Heroku's encrypted configuration system, not in source code.
• Error monitoring: Sensitive headers and authentication tokens are explicitly redacted before error payloads are transmitted to Sentry.

Subprocessors

Toast uses the following third-party subprocessors that may process customer personal data as part of delivering the service:

We will notify customers of material changes to this subprocessor list with reasonable advance notice. A Data Processing Addendum (DPA) is available on request at support@toast.ninja.

Incident Response

Toast commits to notifying affected customers within 72 hours of becoming aware of a confirmed incident involving unauthorized access to personal data, consistent with GDPR Article 33 obligations. Notification will include the nature of the incident, the categories and approximate volume of data affected, and the measures taken to address it.

To report a suspected security vulnerability or incident, contact: support@toast.ninja

Business Continuity

Toast's service continuity relies on the redundancy and backup capabilities of its infrastructure providers. Heroku Postgres provides continuous WAL archiving and point-in-time recovery, with daily backups retained automatically. The application can be redeployed from source within approximately 30 minutes.

Recovery Time Objective (RTO): 4 hours (best effort).
Recovery Point Objective (RPO): 24 hours, or shorter with point-in-time recovery.

Compliance Notes

• SOC 2: Toast has not yet completed a SOC 2 audit. We rely on the SOC 2 certifications of our infrastructure providers as the primary assurance framework for infrastructure-level controls.
• Penetration testing: Toast has not conducted a third-party penetration test. We assess this risk as reduced by our narrow access surface: no code access, no file storage, OAuth-only authentication, and signature-verified inbound webhooks.
• GDPR: Toast offers a Data Processing Addendum for customers who require one. Contact support@toast.ninja to request a DPA.
• PCI DSS: Toast does not store, process, or transmit payment card data. All payment processing is handled by Stripe (PCI DSS Level 1 certified).

Frequently Asked Questions

Can Toast read our source code?

No. The GitHub App permissions Toast requests explicitly exclude repository contents. We receive pull request metadata (titles, states, reviewer assignments) but not diffs, file contents, or any repository content. This is enforced at the GitHub API permission level, not just by policy.

What GitHub permissions does Toast request, and why?

Toast does not request: contents (code), administration, secrets, or any write permission to your repositories.

What Slack permissions does Toast request, and why?

Toast does not request access to read message history, access private conversations, or any administrative Slack permissions.

Who at Toast can see our data?

A small number of Toast personnel with authorized access to the production environment can access account data for support and operational purposes. We do not access customer data unless required to resolve a support issue, and we do not sell or share data with third parties for advertising or analytics purposes.

What happens to our data when we cancel or uninstall?

When you uninstall the Toast GitHub App or Slack App, we stop receiving new data immediately. On request, we will delete your organization's data from our database. Contact support@toast.ninja to request deletion.

Do you sell our data?

No. Toast does not sell, rent, or share customer data with third parties for advertising, marketing, or any commercial purpose unrelated to delivering the Toast service.

Are you GDPR compliant?

Toast processes personal data (names, usernames, email addresses) on behalf of customers who may be subject to GDPR. We offer a Data Processing Addendum (DPA) that governs our obligations as a data processor. Contact support@toast.ninja to request a DPA.

Have you had any security incidents?

No security incidents involving unauthorized access to customer data have occurred.

Can we get a copy of this document for our records?

Yes. Contact support@toast.ninja for a signed PDF version or to request our Data Processing Addendum.