RD
RitualDevSTUDIO
AGENT DEFENSE & OFFLINE APPS
BACK TO PRIVACY CENTER
DEVSECOPS PRIVACY POLICY · LAST UPDATED: NOVEMBER 7, 2026

Privacy Policy for DBShield

Product: DBShield CI/CD Action & CLI·Repository: RitualDev-Lab/DBShield·Category: Database Security & CI/CD Guardrails·Developer: RitualDev Studio

DevSecOps Privacy Mandate: 100% Ephemeral In-Runner SQL AST Parsing

DBShield inspects SQL DDL/DML migration scripts, schema diffs, and database pull requests directly within your private CI/CD execution runner (GitHub Actions, GitLab CI, or local Docker environments). DBShield operates under an absolute Zero Query Retention & Zero Database Connection Credential Storage mandate. Your production database schemas, table names, and migration files are NEVER transmitted to RitualDev cloud servers or third parties.

1. What DBShield Processes in Your CI/CD Pipelines

When DBShield runs as a GitHub Action or CLI tool in your build matrix, it inspects code strictly in ephemeral runner memory:

STATIC SQL AST PARSING

Parses PostgreSQL, MySQL, SQLite, and MongoDB migration files into an Abstract Syntax Tree (AST) to detect breaking schema changes (e.g., dropping columns without deprecation, unindexed foreign keys, table locks).

EPHEMERAL EXECUTION ONLY

All AST generation and policy evaluations execute directly on your CI/CD runner. When the GitHub Action workflow job completes, the runner environment is torn down and wiped.

CREDENTIAL ISOLATION

DBShield never demands or records database master passwords. Shadow migration verifications run against temporary throwaway local container instances (e.g. Testcontainers) that exist solely during CI.

COMPLIANCE POLICY EVALUATION

Evaluates your local dbshield.yml configuration for SOC 2 (CC6.1) and GDPR compliance without external network communication.

2. What We Never Collect or Transmit

RitualDev enforces strict enterprise boundaries:

  • We NEVER transmit your schema DDL files or SQL queries to external servers.
  • We NEVER record actual database row contents or customer data.
  • We NEVER store GitHub repository secrets, database connection URLs, or cloud tokens.
  • We NEVER inject tracking telemetry or usage metrics into your CI build artifacts.

3. GitHub Marketplace & CI Token Permissions

When used as a GitHub Action (RitualDev-Lab/DBShield@v0.2.1), DBShield requires only standard GitHub Action workflow privileges:

  • contents: read — Needed to read SQL migration files in the checked-out repository.
  • pull-requests: write (Optional) — Needed only if you configure DBShield to post automated schema hazard comments directly on pull requests.

4. Enterprise Self-Hosting & Air-Gapped Environments

DBShield is architected for defense-in-depth and regulated industries (financial services, healthcare, government). DBShield can be deployed inside completely air-gapped, isolated on-premise Kubernetes clusters or private VPCs without internet access.

5. Contact & Security Verification

For security architecture reviews, SOC 2 compliance verification, or support:

Security Team: security@ritualdev.in