Enterprise

Your teams ship more change than anyone can review, and coding agents write a growing share of it. Then someone asks a plain question: an auditor, an acquirer, the board, or whoever is running tonight's incident. What changed? Who owns it? What tested it? What else did it touch? The answer is scattered across git, CODEOWNERS, CI logs and the memory of the two people who were there.

Repowise puts that answer in one place. It indexes your repositories once, inside your network, and keeps the evidence for every change and every component current on each commit. Your engineers and their agents use the same index every day to find code, judge risk and fix what matters, so the evidence is a by-product of work that is already happening.

Evidence for every change#

Every merged pull request, merge request or commit becomes a Change Record: the components it touched and who owns them, the tests that reach it, the contracts and decisions it crosses, where it came from, and what happened after it landed. Each item says how it is known (measured, inferred, declared or unknown), so nobody has to take a score on faith.

That turns into the documents people ask you for:

The same evidence runs as a change policy in CI: hold changes to payment code to a higher bar, require tests where none reach, and report it as SARIF or JUnit. These are evidence for your reviews, not a certification, and missing evidence is reported as unresolved, never as a pass. Owners and reviewers are counted, never ranked or named.

Why your security team can say yes#

• Repowise never handles your code or data. Enterprise runs entirely inside your perimeter: in your VPC, on-prem or fully air-gapped. Your code, the index and every analysis stay on your infrastructure, under your own controls and certifications. Raw source is parsed in memory and never stored, and anonymous CLI telemetry carries no code and has four off switches.
• No model in the analysis. The graph, history, health, change risk, tests, dead code and change evidence make zero LLM calls. The same commit gives the same answer every time.
• Optional prose, on your terms. Written docs and answers run on your own provider contract, Azure OpenAI in your tenant, or Ollama offline, chosen per repository. That call goes to your provider, never to Repowise.
• Scoped access. Every caller resolves to a principal limited to named repositories and tools, with hashed, expiring tokens. Your identity provider and directory connect through plugin seams, without forking.
• Your certifications cover it. Because no Repowise-operated system receives, stores or processes your code or data, a vendor SOC 2 report is not the gate for Enterprise: the deployment sits inside the controls you are already audited on. Every compliance report Repowise produces says exactly what it is.

The full review pack: Security and data handling.

Security review for Enterprise#

The questions every security review asks, with the Enterprise answer:

It holds up at your size#

dotnet/runtime, about 15 million lines of code in 58,924 files, indexes on one laptop in two hours with no API key, and every commit after that updates incrementally. Call-graph accuracy is graded against each language's own compiler and published per language, including the rows where we lose: Benchmarks.

What comes next: Foresight#

Foresight learned from years of real commits and fixes. Paste a bug report and it ranks the files the fix will touch: the right file is in the top five for 87% of 493 SWE-bench Verified bugs, with no LLM, on a CPU, air-gap ready. Enterprise customers get it first. See Foresight.

Evaluate it in an afternoon#

Try it on one repository you know well, on one machine, with nothing leaving it:

uv tool install repowise
cd /path/to/your/repo
DO_NOT_TRACK=1 repowise init --yes --no-prose
repowise serve

Then look at what it says about code you know, read the evidence for a change you remember (repowise changes show <id>), and open the assessment you would hand to someone else (repowise report assessment --format html --out assessment.html). If the answers hold up on your code, the next step is a call.

What the commercial licence adds#

The open-source engine is complete: every analysis layer, every language, workspaces, change evidence, policy and reports are AGPL-3.0, and using it inside your company creates no obligation to publish your code. The commercial licence adds the layer an organisation runs on top.

Licences come per seat, per indexed repository with unlimited seats, or enterprise-wide, each with the full commercial feature set (Licensing).

What the licence grants#

Rights to modify and embed without AGPL obligations, a defensive patent grant, IP indemnification, a named support contact with a response-time SLA and a quarterly architecture review, every update during the term, and the right to audit our security practices.

Talk to us#

Tell us about your estate and what you need to prove, and we will scope a deployment, a security review or a pilot with you.

Or write to hello@repowise.dev. Security reviews: security@repowise.dev.