TrustSustain
Sustain is in early access and not live yet. This page sets out the limits it is being built to, so you can check them before you connect anything. When Sustain launches, this page will say exactly what is live.
Access by plan
Watch reads. Maintain can open pull requests. Autopilot adds a separate set of permissions whose only job is stopping a bad release. Those are requested when you move to Autopilot and removed if you move back.
| Watch | Maintain | Autopilot | |
|---|---|---|---|
| GitHub | A read-only app that sees your code, pull requests, checks and workflow runs | Adds a separate app that can push branches and open pull requests. It never commits to your default branch | Same as Maintain. Fixes merge only under the rules in Approval, rollback and brakes |
| Your CI | Reads results | Can re-run or start workflows, then reads the results | Same as Maintain |
| Firebase and Google Cloud | Viewer roles you grant to a Sustain service account | Same as Watch | Adds a separate brakes account that can turn off a Remote Config switch Sustain created, and roll Hosting back to your previous release |
| Google Play | View-only access to your app | Same as Watch | Adds halting a staged rollout |
| App Store Connect | A key you create, with the least privileged role that can read apps and builds | Same as Watch | Adds a second key that can pause a phased release |
| AWS Optional | A read-only role that reads costs, with an external ID unique to your organization | Same as Watch | Same as Watch |
| Stripe Optional | A restricted key that reads your account, webhook endpoints and events. It cannot move money | Same as Watch | Same as Watch |
| Cloudflare Optional | A token that reads your app's zone | Same as Watch | Same as Watch |
Sustain asks for a new permission only when a specific check needs it. Each connection will show its scope in the dashboard and flag anything broader than what Sustain uses.
Hard limits
Every fix goes from a branch to a pull request, through CI and staging, then to a merge. What your own pipeline does after the merge stays yours.
Changes arrive as pull requests. On Maintain you approve every merge yourself.
Sustain monitors billing and never pays a bill. The Stripe key it asks for can only read.
Watch installs a read-only GitHub app. The app that can write is installed only when you move to Maintain.
Brakes are fixed code with thresholds you can see and change. A model never decides to stop a release.
On Autopilot it turns off only the Remote Config switches it added itself.
What Sustain learns goes into a project profile you can read and edit. When your edit and its reading disagree, yours wins.
Risk and policy checks flag possible issues and say when to involve a lawyer. They never claim your app is compliant.
No one at Zetesis fixes anything by hand. When Sustain can't fix something safely, it writes a brief your own developer can pick up.
Approval, rollback and brakes
Approval
On Maintain you approve or decline every fix, from the dashboard or from GitHub. On Autopilot a fix merges on its own only when all of these hold:
Rollback
Rollback opens a revert pull request and runs it through the same checks as the fix. On Autopilot, Sustain compares each merge against how the app behaved before it. If something regresses, it reverts the fix and pauses automatic merging for that fix type until you look.
If a change Sustain made badly breaks your live app, you can start an emergency rollback. It stops Sustain, restores your code to a point you choose and, once you confirm, takes the brake actions on Maintain as well as Autopilot. You get one in any 12 months. Section 17 of the terms covers it, along with service credits and a refund if you'd rather leave.
Brakes, Autopilot only
When a release goes bad, whoever shipped it, Autopilot can halt a staged Play rollout, pause an App Store phased release, turn off a Remote Config switch it added, or roll Firebase Hosting back to your previous release.
Each brake uses its own narrow permission and sends you a plain-English notice when it fires. Lifting a brake is your call.
Credentials and code
Models
Sustain chooses a model for each kind of work, such as writing a summary or preparing a fix, based on how the models score on its own evaluations. You never pick one. Both providers will be listed as subprocessors, and the full subprocessor list will be published on this page before launch.
Who builds Sustain
Sustain is a Zetesis product. The company record, the founder and the public engineering are on the Zetesis verify page.
The terms of service, privacy policy and data processing agreement set out the same commitments as this page in legal form.
Sustain is taking early access signups while it is being built.
Get early access