We can not access
your code.

Plain-language summary

DevSafe is an encrypted git backup tool. Your code is encrypted on your machine before it ever leaves. Your encryption keys never touch our servers. We hold your account details and, if you sign in the DevSafe program, records about your projects: project names, folder paths, remote addresses, backup sizes, commit IDs and scan findings. Those records are not encrypted with your key, so they must not contain protected health information. Your source code never reaches us. If it contains protected health information, it is encrypted with AES-256-GCM on your machine and goes only to your own storage. We can not decrypt it. Not "we will not." We can not.

Client-Side Encryption Declaration

This agreement between HXA Labs LLC ("Business Associate") and the customer ("Covered Entity") establishes the terms under which DevSafe operates as an encryption layer for git backup data. DevSafe's client-side encryption addresses several HIPAA technical safeguards by ensuring that protected health information, if present in source code, is encrypted before it enters any system operated by or accessible to HXA Labs.

Scope of Services

DevSafe provides an encrypted backup encryption layer for git repositories. The service operates as follows:

• Discovery. DevSafe identifies git repositories on the customer's local machine.
• Bundling. DevSafe creates git bundles by reading from the git object database. It does not copy the filesystem.
• Encryption. Bundles are encrypted with AES-256-GCM on the customer's machine using customer-generated keys. Encryption occurs before backup data leaves the local environment.
• Upload. Encrypted ciphertext is uploaded to customer-owned cloud storage (Cloudflare R2, AWS S3, or any S3-compatible provider). HXA Labs does not operate or control the destination storage.
• Verification. The customer can check, on the customer's own machine and with the customer's own key, that each backup is intact and restorable. HXA Labs takes no part in these checks and never sees backup contents.

If protected health information exists within the customer's source code, it is encrypted before leaving the customer's machine. HXA Labs does not receive the backups at all; they go only to the customer's own storage. HXA Labs receives only the service records described in Section 3. The customer's own storage holds encrypted data that only the customer can decrypt.

Data DevSafe Does Handle

HXA Labs collects and stores the following data categories in the normal course of providing the DevSafe service:

• Account data. Email address, display name, and, for GitHub sign-in, the GitHub username and profile picture link. Used for account authentication (email and password, magic link, or GitHub OAuth login), billing communications, and service notifications.
• Project records. Only when the customer signs in the DevSafe program: project names, local folder paths, remote repository addresses (login details removed), backup sizes, commit IDs, and scan findings (file paths, line numbers and the type of problem found). These records do not contain source code, file contents, or encryption keys.
• Billing records. Plan, subscription status and the Stripe customer ID. Card details are held by Stripe.
• Signup check records. The email domain, a score of how the signup form was used, a one-way hash of the IP address, and the resulting risk level.

These data categories are not designed to hold protected health information. Project names, folder paths, file paths and remote addresses are sent as they appear on the customer's machine. They are not encrypted with the customer's key. If they could contain protected health information, the customer should not sign in the DevSafe program on that machine.

Data DevSafe Can Not Access

The following data categories are architecturally inaccessible to HXA Labs. This is not a policy restriction. It is a cryptographic impossibility.

• Customer source code. All source code is encrypted on the customer's machine before it is uploaded to the customer's own storage. HXA Labs receives neither the source code nor the encrypted backups. HXA Labs does not possess the decryption keys.
• Backup contents. Encrypted backups are stored in the customer's own cloud storage. HXA Labs does not have credentials to the customer's storage bucket. Even if HXA Labs obtained the ciphertext, it could not decrypt it.
• Encryption keys. Keys are generated locally on the customer's machine using cryptographically secure random number generation. Keys are never sent to, stored, logged, or cached by any HXA Labs system. A recovery copy, locked with the customer's recovery code, is kept only in the customer's own storage. All key handling happens entirely within the customer's environment.

Technical Safeguards

DevSafe's client-side encryption addresses several HIPAA technical safeguard requirements through the following controls:

• Encryption at rest. Customer data is encrypted with AES-256-GCM before storage. Encryption keys are managed exclusively by the customer. The encrypted data resides in the customer's own cloud storage bucket.
• Encryption in transit. All communications between the DevSafe client and cloud storage use TLS 1.2 or higher. All communications between the DevSafe client and HXA Labs infrastructure use HTTPS with TLS 1.2 or higher.
• Access controls. HXA Labs uses email and password, magic link, or GitHub OAuth authentication with optional TOTP multi-factor authentication. Passwords hashed by Supabase Auth, never accessible to DevSafe. API key authentication for programmatic access, and role-based access control for team plans. Access to internal systems follows the principle of least privilege.
• Key management. Customer-side key generation using cryptographically secure random number generators. Keys never leave the customer's machine.
• Integrity verification. Any change to a stored backup is detected when it is opened, and the changed backup is refused. Each backup is checked as a complete git bundle before it is encrypted, and the customer can check stored backups at any time with devsafe verify.
• Audit trail. DevSafe keeps a record of each backup on the customer's machine, and can export a proof of backup state that the customer's auditors can check.

DevSafe is an encryption layer. It is not a compliance program. Customers are responsible for their own HIPAA compliance program, risk assessments, and administrative safeguards. DevSafe's architecture provides the technical encryption controls that support a customer's broader compliance posture.

SOC 2 Type II certification is on the HXA Labs roadmap with a target observation period beginning in 2027.

Breach Notification

In the event of a security incident affecting HXA Labs systems, HXA Labs will notify affected customers within 48 hours of confirmed discovery. Notification will include:

• A description of the incident and the data categories potentially affected.
• The date and time of discovery.
• The steps HXA Labs is taking to contain and remediate the incident.
• Recommendations for customer action, if any.

HXA Labs will cooperate with the customer's incident response process. HXA Labs will preserve relevant logs and provide technical assistance as needed to support the customer's breach assessment and regulatory notification obligations.

Subcontractors

HXA Labs uses the following infrastructure providers to operate the DevSafe service. Flow-down obligations apply where applicable. None of these providers have access to customer source code, backup contents, or encryption keys.

• Cloudflare. Website hosting, DNS, CDN, DDoS protection, and web application firewall. Cloudflare processes website traffic metadata (IP addresses and request details) and may count visits with its cookie-free Web Analytics. Backups do not pass through HXA Labs' Cloudflare account; a customer who chooses Cloudflare R2 for storage uses the customer's own Cloudflare account.
• Supabase. Authentication, database, server functions and logs. Supabase stores the account, billing, signup check and project records listed in Section 3. Supabase does not receive source code, backup contents, or encryption keys. Database encryption at rest is enabled.
• Stripe. Payment processing. Stripe receives the customer's email address, DevSafe user ID and plan choice, and the payment details the customer enters at Stripe checkout. Stripe does not receive source code, project records, or encryption keys. Stripe is PCI DSS Level 1 certified.
• Resend. Email delivery. Resend receives email addresses and email content (login links, notifications, product email, and contact form messages delivered to HXA Labs). Resend does not receive source code, backup data, or encryption keys.
• Google. Web fonts for website visitors (IP address and browser details), and Google Workspace, which hosts the HXA Labs inbox that receives contact form messages. Google does not receive source code, backup data, or encryption keys.
• Anthropic. Writes answers to questions typed into the Ask Voss box on blog posts. Receives the question and the blog post text. Anthropic does not receive customer records, source code, backup data, or encryption keys.
• jsDelivr. Delivers the sign-in library to website visitors' browsers. Sees IP addresses and browser details only.
• GitHub. GitHub sign-in, DevSafe downloads and the DevSafe program's daily update check. Receives GitHub profile basics for sign-in, and IP addresses and request details. GitHub does not receive project records, source code from DevSafe, backup data, or encryption keys.

HXA Labs will notify customers before adding new subcontractors that process customer data. The current subcontractor list is maintained on the Trust Center.

Customer Responsibilities

Because only the customer holds the encryption keys, certain responsibilities rest with the customer. The customer is responsible for:

• Key management. Generating, storing, backing up, and protecting encryption keys. If the customer loses their encryption key, HXA Labs can not recover it. Data encrypted with a lost key is permanently inaccessible.
• Storage configuration. Configuring their cloud storage bucket (Cloudflare R2, AWS S3, or compatible provider) with appropriate access controls, encryption settings, and retention policies. HXA Labs does not manage or monitor customer storage buckets.
• PHI determination. Determining whether their source code repositories contain protected health information. HXA Labs can not inspect customer code to make this determination. The customer is in the best position to know what their code contains.
• Compliance program. Maintaining their own HIPAA compliance program, including risk assessments, workforce training, administrative safeguards, and physical safeguards. DevSafe provides technical encryption controls. It is not a substitute for a compliance program.
• Access control. Managing team member access, revoking access for departing personnel, and rotating keys according to their own security policies (key rotation in DevSafe is temporarily unavailable while it is rebuilt).

Term, Termination, and Data Return

When executed, this BAA will be effective as of the date the customer begins a paid DevSafe subscription. It will remain in effect for the duration of the subscription.

Upon termination:

• HXA Labs will delete the customer's account, billing and project records within 30 days of subscription termination. The customer may request immediate deletion at any time.
• The customer retains full ownership of all encrypted backups in their own cloud storage. These backups are stored in the customer's bucket, under the customer's control, encrypted with the customer's keys. HXA Labs has no access to delete, modify, or read this data.
• Recovery needs no account. The customer can restore backups with the free DevSafe program and the customer's key, with no DevSafe account and no dependency on HXA Labs servers. No vendor lock-in.

HXA Labs will certify in writing that all customer data within its systems has been deleted upon request following termination.

Questions about this agreement?

This BAA template is in preparation. For questions about HIPAA compliance, BAA execution, or DevSafe's security architecture, contact us.