Security and permissions

BranchDeploy is designed to make an existing Azure DevOps deployment workflow easier to trigger, not to bypass your existing controls. The free Azure DevOps extension workflow queues your configured Azure Pipeline as the current Azure DevOps user. If a user cannot queue the pipeline manually, BranchDeploy cannot queue it for them.

Summary

Free extension workflow

The core BranchDeploy feature is a Visual Studio Marketplace extension that adds a deploy action to Azure Boards work items. This workflow:

• Requires no BranchDeploy account.
• Does not require a BranchDeploy-hosted backend to deploy. The settings page checks your licence status, and anonymous usage telemetry is sent unless you turn it off.
• Queues your configured Azure Pipeline as the currently authenticated Azure DevOps user.
• Does not store credentials, tokens, or pipeline outputs.
• Reads Development links from the work item (linked Azure Repos branches and pull requests).

A project admin must configure BranchDeploy in Project Settings → BranchDeploy before any deployments can be queued. Unconfigured projects cannot deploy.

Pro cloud, Teams, and MCP features

Pro features extend BranchDeploy beyond the core extension and involve a BranchDeploy-hosted backend, account, and licence. Pro features include:

• Unlimited projects and environments.
• 90-day deployment audit log stored in the BranchDeploy backend.
• Microsoft Teams bot (requires a BranchDeploy account and Azure DevOps connection).
• AI assistant integration via MCP (requires a BranchDeploy account; ChatGPT signs in, other clients use a generated API key).

Azure DevOps permissions

BranchDeploy does not grant, elevate, or bypass Azure DevOps permissions. It queues pipelines as the authenticated user in the context of the extension.

For a user to deploy with BranchDeploy, they need:

• Queue builds permission on the target pipeline.
• Access to the Azure DevOps project.
• A work item with a linked Azure Repos branch or pull request in the Development section.

Approvals and checks on Azure DevOps environments, such as branch control, still apply to every run BranchDeploy queues. BranchDeploy cannot bypass them. Pipeline trigger branch filters only govern automatic CI runs, so use BranchDeploy branch allowlists or environment checks to restrict which branches can deploy.

Pipeline queueing

BranchDeploy queues your configured Azure Pipeline by calling the Azure DevOps API on behalf of the current user. The pipeline run is created with the resolved branch as the source branch. BranchDeploy passes optional parameters (environment name, work item ID) with configurable parameter names.

BranchDeploy does not modify your pipeline definition, YAML, or repository. It only triggers a run of an existing pipeline.

Branch allowlists

BranchDeploy supports branch allowlists using glob patterns. Allowlists restrict which branches can be deployed to a given environment before the pipeline is queued.

If the resolved branch does not match the configured allowlist patterns, BranchDeploy blocks the deployment and shows an error — the pipeline is never called.

Example patterns:

feature/*
bugfix/*
hotfix/*
release/*
users/*/*

The free tier supports one branch allowlist for the single configured environment. Pro adds per-environment allowlists.

Confirmation step

Every deployment through BranchDeploy requires an explicit confirmation step. The user sees:

• The resolved Azure Repos branch or PR source branch.
• The target environment name.
• The work item title and ID.

There is no way to skip or auto-approve the confirmation step. The pipeline is only queued after the user clicks Deploy.

Data handling

Free extension workflow

The free extension reads work item data via the Azure DevOps extension SDK within the browser session. No work item data, branch names, or pipeline information is sent to a BranchDeploy-hosted backend during the core deploy action. Separately, the extension checks your organisation's licence status with the BranchDeploy backend (this sends your Azure DevOps organisation name), and sends anonymous usage telemetry unless you turn it off in Project Settings → BranchDeploy.

Pro account and cloud features

When you create a BranchDeploy account to access Pro features, your account data (email address, the Azure DevOps organisation your workspace is linked to, billing status) is stored in the BranchDeploy backend. The deployment audit log stores a record of each deployment, including the name and email of the person who triggered it, for 90 days on Pro, then deletes it automatically.

Connecting the extension

Pasting a connection token into Project Settings → BranchDeploy links your Azure DevOps organisation to a BranchDeploy workspace. To prove the request comes from inside that organisation, the extension sends a short-lived Azure DevOps access token once. The backend uses it to check your identity with Azure DevOps and does not store it. If the organisation is already linked to a different workspace, that workspace's owners and admins are emailed to approve the move, and it goes ahead after 7 days unless they decline. After connecting, the extension's token only works in the organisation its workspace is linked to.

Teams bot credentials

The Teams bot and AI assistant (MCP) features use an Azure DevOps personal access token (PAT) saved in your BranchDeploy account, because there is no browser session in those contexts. One PAT, saved by a workspace admin, serves everyone in the workspace. PATs are encrypted at rest. Actions taken with it appear in Azure DevOps as the PAT's owner, so we recommend creating it from a service account. You can revoke and replace a PAT from your account settings at any time.

MCP API keys

MCP API keys authenticate requests from AI assistants (Claude Code, Cursor, or any MCP-compatible client). Each member generates their own key, and it acts as that member: it is limited to their role, deployments it queues are recorded under their name, and it is checked on every request, so it stops working as soon as they leave the workspace. Keys are hashed before storage. Members can revoke their own key and admins can revoke anyone's, at any time. ChatGPT and Claude use BranchDeploy sign-in instead of an API key; their sign-in tokens are also hashed before storage.

Audit log

BranchDeploy Pro stores a 90-day deployment audit log in the BranchDeploy backend. Each log entry records:

• The Azure DevOps organisation and project.
• The work item ID.
• The repository and resolved branch.
• The target environment.
• The name and email of the person who triggered it.
• Where it came from (Azure DevOps, Teams, or an AI assistant).
• The pipeline run ID and link returned by Azure DevOps.
• The timestamp and outcome of the deployment.

The free tier does not include an audit log.

Company and assurance

Who builds BranchDeploy

BranchDeploy is built and operated by Pixel Funnel Ltd, company number 08497619, registered in England and Wales and trading since 2013. It is developed and maintained by its founder, Grant Bajere, so security questions and vulnerability reports go straight to the person who writes the code. See security.txt for the reporting contact.

Certifications and independent testing

BranchDeploy does not currently hold SOC 2 or ISO 27001 certification and has not yet had an independent penetration test. We will update this page when that changes. In the meantime, BranchDeploy is designed so that as little as possible depends on trusting us:

• The free workflow keeps your data in Azure DevOps. It runs in your Azure DevOps browser session, stores its settings in Azure DevOps Extension Data, and sends no work item, branch, or pipeline data to BranchDeploy.
• No new permissions. Deployments from the work item run as the signed-in user, inside existing Azure DevOps permissions, approvals, and environment checks.
• Narrow extension scopes. The extension requests only vso.work (read work items), vso.code (read branches and pull requests), vso.build_execute (queue the configured pipeline), and vso.extension.data_write (save its own settings).
• Credentials protected at rest. Azure DevOps PATs saved for Pro features are encrypted with AES-256-GCM. API keys, connection tokens, and sign-in tokens are stored only as hashes.
• Certified infrastructure. The Pro backend runs on Cloudflare, which holds SOC 2 Type II and ISO 27001 certifications. Payments are handled by Stripe, a PCI DSS Level 1 service provider; BranchDeploy never sees card details.

The full list of subprocessors (Cloudflare, Stripe, Sentry, PostHog, and Brevo) and what each one handles is in the privacy policy.

Security questionnaires

If your organisation needs a vendor security questionnaire or a data processing agreement before installing, get in touch and we will work through it with you.

Frequently asked questions