FAQ
General
What is Govlin?
Govlin is a Git governance product. It links every change to its ticket, pipeline, quality result and approvals, tells you what needs your attention, computes whether a release can ship and gives you the evidence to prove what happened. See the Introduction.
Is Govlin the same product as GitGov?
Yes. GitGov was the previous name. The installer, the domain gitgov.cloud, the gitgov.toml file and the code keep the historical name.
Who is Govlin for?
Engineering teams and organizations that need to know whether a release can ship and to prove what happened: developers, architects, PMs, auditors and administrators. Each role gets default permissions; see Connect Govlin.
Is Govlin open source?
Govlin is developed by Yohandry Chirinos, a Venezuelan software engineer with over 10 years of experience in enterprise environments, banking, fintech and startups. Govlin is not open source.
What technology does Govlin use?
- Desktop app: Tauri (Rust) and React, published for Windows.
- Server: Axum (Rust) with a PostgreSQL database.
- Website: Next.js, at gitgov.cloud.
What Govlin Does NOT Do
Does Govlin read my source code?
No. No file content, diff or patch ever leaves your machine. The Desktop sends Git metadata: event type, status, commit SHA, branch, author and GitHub login, commit message, staged file paths (up to 500), repository, computer name, operating system and app version. The change impact analysis runs locally and is not sent.
Does Govlin monitor my screen, keystrokes, or applications?
No. Govlin records the Git operations made from the app and receives the rest from your integrations. It has no access to your screen, clipboard, browser or IDE. Terminal input is passed unchanged to your shell; Govlin does not filter or rewrite it.
Does Govlin analyze code quality?
No. Govlin does not lint or review code. It receives quality gate results from SonarQube and links them to each change.
Does Govlin replace CI/CD?
No. It receives results from GitHub Actions, Jenkins and SonarQube. It does not run builds, tests or deployments; your CI can ask it for a rule check or a deployment authorization.
Does Govlin block Git operations?
Only if your rules say so. Each group of rules is Not checked, Warn (the push goes through with a warning) or Block (the push is refused). At the Observe only level nothing is blocked. See Rules.
Does Govlin make HR or disciplinary decisions?
No. Signals are advisory observations. The deploying organization is fully responsible for any decisions made based on signals.
Does Govlin profile individual developer productivity?
No. There are no "lines of code", commit scores or productivity rankings.
Does Govlin sell or share my data?
No. All data belongs to the deploying organization, and Govlin does not sell it. One feature can send part of it to a third party: when an administrator of an organization enables external AI processing, the chat and the governance copilot send what they cannot answer locally to an external AI provider. It stays off until an administrator enables it; see Security.
Does Govlin store passwords or secrets?
No. Access keys are stored as SHA-256 hashes. Govlin never collects passwords, tokens or .env values, and it checks the names of your GitHub Actions secrets, never their values.
Data & Security
Where is my data stored?
In the PostgreSQL database of the Govlin server. The Desktop keeps a local outbox for events waiting to be sent and a local database of the activity on that computer. See the Security Policy.
Is my data encrypted?
Yes: HTTPS between the Desktop and the server, an encrypted database at rest, access keys stored as SHA-256 hashes, and the Desktop credential in the Windows credential store.
Can records be modified or deleted?
No. Events, decisions and deployment authorizations are append-only. Computing a state records nothing; only decisions and the evidence someone creates are recorded.
Who can see my events?
Data is scoped by organization, and each person sees the sections their permissions allow. Releases, Setup, Organization, Tickets without code and Audit are administrator views today.
Can I export my data?
Yes. Evidence → Audit exports the event history of a date range as JSON and keeps the list of previous exports.
Does Govlin support the right to erasure (GDPR)?
Yes. An anonymization and deletion endpoint is available within the organization's scope.
Desktop App
What platforms does Govlin Desktop support?
Windows 10 and 11, 64-bit.
How do I sign in?
With GitHub. The app shows a code you confirm on github.com, and the server issues a credential bound to your membership in the organization. An administrator adds you or invites you; without a membership, the app accepts an access key an administrator issued for you.
What happens if I lose connectivity?
Events wait on your computer and are sent when the connection returns. Settings → System shows whether anything is pending.
Can I lock Govlin with a PIN?
Yes. Settings → Account → Local PIN (4 to 8 digits) locks Govlin on this computer until the PIN is typed.
How do I update the Desktop App?
Settings → System → Updates: choose the Stable or Beta channel, check and install. Updates are signed.
Which languages does it support?
English and Spanish, in Settings → Preferences, together with the time zone and desktop notifications.
Organizations & Teams
How do I add people to my organization?
Settings → Organization. Add a person with a role, or invite them by GitHub login or email. Invitations can be renewed or revoked.
What roles are available?
Admin, Architect, Developer, PM and Auditor. A role only sets default permissions. See Connect Govlin.
Can I disable a person without deleting them?
Yes. Their keys stop working on their next request and their history stays.
How do I manage access keys?
Settings → Organization → Access keys: issue keys for services and CI, list and revoke them. A key is shown only once.
Using Govlin
What does the Action Center show?
An inbox of problems: each cause once, with what is happening, why it matters, the action that fixes it and the evidence behind it, plus What Govlin receives today, one line per integration. See Using Govlin.
How does Govlin know a change belongs to a ticket?
It reads the ticket IDs (such as KAN-42) in the commit message and branch when the change arrives, and in the title and comments of a merged pull request when its webhook arrives.
What can I ask Govlin?
About the selected change, ticket or release, and about the team's activity, such as who pushed where and when. Answers cite their sources. When the AI answer is not available, the answer says it is an evidence summary; when data is missing, it says so. Ask is available to administrators, architects and PMs.
What time zone does Govlin use?
Everything is stored in UTC and shown in the time zone chosen in Settings → Preferences.
Compliance
Does Govlin help with SOC 2?
Govlin is not a SOC 2 certification, attestation or official control mapping. It records append-only audit trails, enforces role-based access and exports evidence, and it can map that evidence to a control pack your organization imports. Whether the evidence meets a SOC 2 control is for your organization and its auditor to decide.
Does Govlin help with GDPR?
Yes. Data minimization, right of access, portability (export), right to erasure, controller/processor distinction. See the Security Policy.
Does Govlin help with ISO 27001?
Govlin is not an ISO 27001 certification or an official Annex A mapping. It records append-only audit trails, enforces role-based access and exports evidence, and it can map that evidence to a control pack your organization imports. Whether the evidence meets an Annex A control is for your organization and its auditor to decide.
What is a "signal"?
An automated flag for a potential rule deviation (for example a push to a protected branch or a commit without a ticket). Advisory only; it requires human review.
Related
- Security Policy: encryption, storage, access controls.
- Privacy Policy: legal terms for end users.
- Introduction: getting started with Govlin.