Security
Security at Virgo AI
Virgo AI handles engineering activity with the same rule the product uses everywhere: activity, not surveillance. We collect the minimum work signals needed to draft a standup, keep developers in control of what gets shared, and make every connected scope visible.
We do not train models on customer data.
We do not sell activity data.
We do not publish updates until a human reviews them.
We support deletion requests through privacy@virgo.ai.
Connected tools
What Virgo AI can access
These are the current integration scopes used by the app. We keep the table explicit so developers can see exactly what they are authorizing before they connect a tool.
GitHub
repo, read:user
Pull request, commit, review, and author metadata used to draft standups.
Virgo AI does not score developers or publish anything automatically.
Linear
read
Issue status, assignee, and cycle context for the work you connect.
Read-only access. Disconnecting removes future sync access.
Jira
read:jira-work, read:jira-user, offline_access
Ticket status, assignee, project, and issue metadata needed for updates.
Refresh access is used only to keep authorized work signals current.
ClickUp
OAuth workspace selection
Task status, assignee, and recent task updates needed for standup drafts.
Virgo AI reads tasks the connected ClickUp user can access and does not publish to ClickUp.
Slack
chat:write, users:read, users:read.email, channels:history, im:write
Team routing, user lookup, standup reminders, and selected channel context.
Channel history is for authorized work channels, not private productivity monitoring.
Microsoft Teams
offline_access, User.Read, Team.ReadBasic.All, Channel.ReadBasic.All, ChannelMessage.Send
Post reviewed reminders and manager digests to the Teams channel an admin selects.
Teams V1 does not read channel messages or feed Teams activity into AI Assist.
Human-reviewed sharing
Drafts stay private until the developer reviews and submits them. No standup is posted from raw activity without that review step.
Encrypted tokens
OAuth tokens are encrypted by the application before storage using the configured encryption key, and all traffic runs over TLS.
Org-scoped access
Workspace data is scoped to the authenticated organization. Admin-only settings protect billing and bring-your-own-key controls.
Data minimization
Virgo AI stores the work signals needed to generate drafts, source links, and standup history. It avoids individual productivity rankings.
AI data handling
Customer activity is used to generate the requested draft or digest. Virgo AI does not use customer data to train models, and provider retention follows the configured production agreement for the workspace.
Retention and deletion
Standup history follows the plan limit shown on pricing. Deleted accounts and workspaces can request deletion through privacy@virgo.ai, with completion tracked within 30 days.
Compliance status
SSO and audit controls are planned for Enterprise. SOC 2 is not claimed today. To report a vulnerability, email security@virgo.ai.
Developer trust rule
Virgo AI should feel like a draft assistant, not a monitoring system. Managers see submitted updates, source-linked blockers, and team-level health. They do not get an automatic individual productivity score.