Security and data

What runs where

Bridge’s functions and its database run in Frankfurt, Germany, and the daily backup is kept in Paris, France. Pages are static files served from Vercel’s global network. GitHub, the email provider and your AI provider are services Bridge uses as they are; Bridge does not choose where they run.

Your design system lives in your team’s own GitHub repository, and stays there. Bridge reads it on GitHub and sends changes back as branches and pull requests. The default branch only changes when a pull request merges on GitHub, under your repository’s own rules.

What Bridge stores

Bridge keeps records about people and teams, not your design system. Everything below lives in one Upstash Redis database, except the session cookie (in the browser), and the backup and the screenshots of private explorations (Vercel Blob). Bridge encrypts the GitHub tokens it keeps (for the AI connector and the plugin hand-off). Other records are not encrypted by Bridge itself, beyond what the storage provider does.

Backups hold accounts, members, invites and team records. They leave out sign-in codes and the AI connector’s connections and tokens. A deleted account can stay in a backup until that backup ages out.

What Bridge does not store

• Passwords. There are none: people sign in with GitHub or with a one-time code sent to their email.
• A lasting copy of your design system. Tokens, components and docs stay in your repository; Bridge keeps only the short-lived copies above.
• Studio’s GitHub sign-in. It stays in the person’s browser (local storage). Bridge’s token function swaps GitHub’s one-time code for a token and returns it without storing or logging it.
• The Figma plugin’s GitHub sign-in. It stays on that computer, in Figma’s plugin storage, never in the Figma file.
• AI keys or AI conversations. Bridge’s servers hold no AI key. The connector sees the tool calls your assistant makes, not the conversation.
• Analytics or tracking. The site has no analytics script. Bridge’s functions log nothing about people; the only log lines are blocked-content reports from browsers and a warning when the backup is not set up. The hosting platform keeps its own request logs.

Access and permissions

GitHub decides who can do what. People with GitHub act as themselves, with their own sign-in, and never get more than their own access to the repository. People without GitHub go through Bridge, with narrower limits (below). Bridge adds review rules on top; your branch protection on GitHub still applies.

The GitHub App

Bridge uses one GitHub App, Bridge Direct. A repository admin installs it on the design system repository only (“Only select repositories”). One consent on GitHub covers reading, suggestions and saving changes.

• Bridge Direct opens branches and pull requests, and files suggestions as issues: Contents, Pull requests and Issues read and write, Administration read and write (read only is possible if your admins turn branch protection on themselves), Checks, Commit statuses, Metadata and Organization members read. Optional: Workflows read and write, only so Studio can open the pull request that adds the automatic measure workflow (.github/workflows/bridge-measure.yml); without it, Studio gives that file to commit from GitHub.
• It asks one account permission: Email addresses, read only, so an invite reaches the person it was sent to.

Bridge’s server holds Bridge Direct’s private key. With it, the server can act on every repository where Bridge Direct is installed, within the permissions above. It uses that for a few jobs only: changing collaborators when someone accepts an invite, serving a private Library to readers without GitHub, carrying out changes for email members, shipping token value changes, and removing a deleted person’s name from their requests. Each time it asks GitHub for a token limited to one repository, often to fewer permissions, and never stores it.

Roles

• Can edit: write access on GitHub. Reviewer: write access, plus listed as a design or tech owner in bridge.config.json. Admin: admin on GitHub.
• People without GitHub can join by email as Can edit or Admin, never Reviewer: approvals happen on GitHub. An email member’s changes go through Bridge with strict limits: design files only (tokens, docs, specs), on their own branches, never the default branch, never a merge or a review, 300 writes a day by default.

Reviews and merging

• Every change is a pull request with a risk tier. Studio, the connector and the CLI read the same verdict: checks pass, the approvals the tier needs (one owner for low risk; a design owner and a tech owner otherwise), no changes requested, no conflict.
• A person merges, with write access and the right to ship. GitHub never lets authors approve their own pull request.
• Your AI assistant acts as the person who connected it, and never merges through Bridge’s connector: the merge tool is neither offered nor accepted there. A person merges, from Studio or GitHub. A pull request the assistant opens is authored by the person who connected it, so someone else has to approve it.
• One exception, by design: token value changes. Once the checks pass, Bridge approves and merges a pull request that only changes token values, from a branch of the repository itself (never a fork). A push from the Figma plugin counts as design-approved only when its author, with write access, asks for it, and Bridge has signed it for that pull request, that author and that exact commit; any new commit needs a new signature. A value change opened anywhere else needs a design owner’s approval on its latest commit. Bridge checks the changed files again at the latest commit before it ships. Renamed or removed tokens, code and guardrail files always wait for a developer.
• Owner override, for solo maintainers: off unless bridge.config.json turns it on, for listed owners only, only when approvals are the one thing missing. It needs a written reason (20 characters at least by default), posted on the pull request before the merge and repeated in the merge commit. If GitHub refuses the merge, the comment says “Not merged”.

Network and APIs

• The Figma plugin may only reach https://api.github.com and https://bridge.floriangouloubi.com. Figma enforces that list.
• Studio pages send a strict Content-Security-Policy: scripts from the site itself (and Vercel’s preview toolbar) only, no embedding of Bridge in other sites, no plugins. Pages may call GitHub’s API and, only when a person adds their own key for drafting docs, Anthropic’s API.
• Every Bridge function answers with Cache-Control: no-store. Calls that change something must come from a page of the site itself (Origin checked), except the ones the Figma plugin and AI assistants make, which carry a token instead of a cookie.
• The connector at /mcp only answers with a Bridge token, issued through OAuth 2.1 with PKCE (S256), for one person, one team and one app. Tokens travel in headers and bodies, never in a URL.

AI

Bridge runs no AI model and its servers hold no AI key. The AI is your team’s own assistant, in your company’s own account: Claude, or any assistant that can use an MCP connector. What your company has agreed with that provider is what applies.

• Connecting. A person adds Bridge’s connector address in their assistant, signs in to Bridge, picks a team, and confirms on GitHub. Bridge checks with GitHub that this person can write to the team’s repository.
• What the assistant receives. What that person could read on GitHub in that one repository: tokens, components, docs and guidelines, change history, reviews and comments, requests and the state of branches.
• What it can do. What the person could do, under their GitHub account: start branches, open draft pull requests, comment and review. It never merges, and never writes straight to the default branch.
• What Bridge sees. The tool calls, not the conversation. For three component fix tools, it keeps the steps (what was read, each attempt’s result, the pull request) for 7 days so the team can follow along.
• The Figma plugin never calls an AI provider and has no place for an AI key. “Ask Claude to fix it” opens the team’s own Claude in the browser.
• Optional, per person. On a Library page, someone may paste their own Anthropic API key to draft docs. It stays in that browser and goes only to Anthropic’s API, with that page’s text.

Subprocessors and DPA

The companies below handle data for Bridge. GitHub is not on the list: it is your team’s own provider, under your own agreement with GitHub, and Bridge works inside your repository there. Your AI provider is the same: your company’s own account.

All three are companies based in the United States, even where the data sits in Europe. A data processing agreement (GDPR article 28) is available as a template, with this list as its annex. It is a starting point to review and sign together, not a signed or certified document.

Deletion and offboarding

• Remove a person. GitHub people: remove them from the repository on GitHub. Email members: an admin removes them in Studio, Settings, Members, which ends their sessions at once.
• Remove an AI connection. In Studio, Settings, Claude: the person who connected it, or a team admin, removes it. Its tokens stop working at once. A connection unused for 90 days ends on its own.
• Remove Bridge from a repository. A repository admin uninstalls the Bridge apps on GitHub (repository or organization settings, GitHub Apps). Each person can also revoke their own sign-in: GitHub, Settings, Applications, Authorized GitHub Apps. GitHub then refuses every token of that sign-in, including the ones Bridge keeps for their AI connections.
• Delete an account. In Studio, the menu with your name, Account settings, Delete my account. It removes the account, its memberships, join requests and sessions at once, and ends every AI connection the person made, with the GitHub tokens kept for them. Changes the person sent stay in the team’s history, signed “A former member”. Backups age out within 30 days.
• Delete a team. A team made in Bridge: an admin opens Settings, Danger zone, Delete this team, and types the team’s name to confirm. Everyone on it loses access at once; its members, invites, requests to join, AI connections, name and settings go from Bridge’s storage at once.
• Disconnect a team from Bridge. A team connected to a repository: an admin opens Settings, Danger zone, Disconnect this team, and types the team’s name. Bridge forgets the same things as for a deleted team. The repository, its history and its settings stay on GitHub: Bridge never changes them. People with access to the repository on GitHub can still open it in Bridge until a repository admin uninstalls the Bridge apps (see above).
• Remove your design system. Nothing to delete on Bridge’s side: it lives in your repository. Short-lived copies expire on their own within 24 hours.

What deleting or disconnecting a team leaves: copies of what Bridge read from GitHub expire on their own within 24 hours, Claude’s work in progress on a component within 7 days, notices already in people’s daily summaries within 30 days, and backups within 30 days.

Audit the code, report a problem

All of Bridge is public in one repository: the site, its functions, the connector, the Figma plugin, the CLI and the MCP server are under the Functional Source License (FSL-1.1-MIT, each version becomes MIT after two years), and the components and tokens are MIT. Your team can read every line above, run the tests (npm test) and run its own copy.

Found a security problem? Report it privately through GitHub’s security advisory form for the repository. Please do not put the details in a public issue. There is no dedicated security email.

Not in place yet

Said plainly, so nobody has to ask. Ask on GitHub if one of these blocks you; there are no dates.

• No certification or outside audit: no SOC 2, no ISO 27001, no penetration test report.
• No signed data processing agreement yet: a template is ready to review and sign with your company.
• No single sign-on (SAML, OIDC, Okta, Google Workspace). Sign-in is GitHub or a one-time email code.
• No choice of data region per team: every team’s records are in Frankfurt. The email provider’s region is not chosen by Bridge.
• No step-by-step self-hosting guide, though the code can run on your own Vercel project.
• No encryption with your own keys. Bridge encrypts only the GitHub tokens it keeps.
• One server secret does several jobs: it signs sessions and is the source of the keys that encrypt the kept GitHub tokens and sign Figma pushes (each key derived for one purpose). Rotating it signs everyone out and ends every AI connection.
• No audit log of Bridge’s own actions beyond what GitHub records (commits, reviews, comments).
• No uptime commitment or support agreement.