Propel Code
Propel Code is an AI pull-request reviewer for GitHub and GitLab that reads your architecture, codebase and team policies before commenting. Built for engineering teams buried under AI-generated code, it aims for actionable signal instead of comment noise.
What is Propel Code?
Propel Code is an AI pull-request review platform published by Propel Platform, Inc., a San Francisco company. The site sells it as "the AI Tech Lead that understands your codebase": rather than commenting line by line in isolation, Propel reads a repository's architecture, its wider codebase and the team's own policies before it says anything, so that senior engineers stay focused on the changes that matter.
The problem it addresses is stated plainly on the home page. AI now writes a growing share of production code, which multiplies the volume that has to be reviewed; manual review does not scale, and existing AI reviewers produce more noise than signal. The site's own critique of the category cites ten or more mostly off-topic comments per pull request, shallow analysis and generic feedback. On the manual side it points to bugs slipping through, 8+ hours a week spent reviewing, senior engineers turned into bottlenecks, and rubber-stamped reviews born of fatigue.
Two ideas carry the answer. The first is independence: when the same AI system writes and reviews the code, blind spots compound, so Propel reviews work produced by Cursor, Claude Code, Codex, Devin and humans alike. The second is multi-model analysis, with several frontier models running in parallel and automatic failover between them; the Enterprise page names GPT-4o, Claude 3.5 and Gemini Pro. Six building blocks are advertised: Multi-model analysis, PR Reviews, PR Summaries, Team Intelligence, Codebase Insights and a Knowledge Base. The tool learns team patterns and adapts to the house style, and rules can be added through a PR comment, the knowledge-base page, a .propel/rules file or an existing repository file.
It plugs into GitHub and GitLab on every tier, Bitbucket on Enterprise, plus Slack, Linear, a REST API and a dashboard. Its most checkable claim is the benchmark: a 2026 suite written by a third party, run on production open-source pull requests across seven tools, places Propel first with a 64% F-score (68% precision, 61% recall), ahead of Cursor Bugbot at 49%, Greptile 45%, Codex Code Review 41%, CodeRabbit 39%, Claude Code 31% and GitHub Copilot 25%. Separately, and with no published methodology, the home page claims 60% faster reviews, 3x more merged pull requests, 50% of pull requests improved before merge and 15 hours saved per engineer per month. Named customers include the CTOs of Chroma and Pine.
What it does
- Reviews every pull request automatically the moment it is opened, using the architecture, the wider codebase and the team's own policies as context
- Runs the analysis across several frontier models in parallel, with automatic failover between them
- Posts code suggestions that can be applied directly from the review, instead of generic remarks
- Applies a shared knowledge base of team rules to every pull request across the connected repositories
- Scans for security vulnerabilities, from basic checks on Starter to enterprise-grade scanning on Enterprise
- Writes pull-request summaries and renames pull requests on demand through the @auto keyword, optionally with a ticket number
- Pushes notifications into Slack, opens Linear tickets from review comments, and reports team and codebase metrics through Team Intelligence and Codebase Insights
When to use Propel Code / When not to
A quick filter to help you decide if Propel Code is the right fit.
When to use Propel Code
- Engineering teams already standardized on GitHub or GitLab, with Slack and Linear alongside: Starter covers up to 50 developers, Professional up to 500 and Enterprise is uncapped.
- Organizations where a large share of the code is machine-written by Cursor, Claude Code, Codex or Devin, and needs a reviewer that did not write it in the first place.
- Teams whose senior engineers have become the review bottleneck, a situation the site quantifies at 8+ hours of manual review per week.
- Engineering leaders who care as much about architectural soundness as about correctness, and who want review and velocity metrics through Team Intelligence and Codebase Insights.
- Large organizations under data-residency constraints, addressed by the on-premise, air-gapped and private-cloud deployments offered at the Enterprise tier.
When not to use Propel Code
- Hobbyists, students and occasional users: there is no permanent free plan, only a 30-day trial, and the Terms restrict the service to users aged 18 and over.
- Teams with heavy pull-request volume on the entry tiers, since quotas are capped at 1,000 pull requests per month on Starter and 10,000 on Professional.
- Bitbucket-first teams outside the Enterprise tier: the pricing comparison table marks Bitbucket as unavailable on both Starter and Professional.
- Regulated workloads, as the Terms state that the service is not tailored to comply with industry-specific regulations such as HIPAA or FISMA, and forbid any use that would breach the Gramm-Leach-Bliley Act.
- Anyone needing EU data residency on the hosted service, a mobile app, a browser extension or a non-English interface: cloud hosting is US-only and everything ships in English through the web app, the Git bot and the API.
How to use Propel Code
A typical end-to-end flow, from setup to results.
- Create an account or sign in on the Propel dashboard through the site's Try Propel for Free button; the 30-day trial asks for no credit card.
- Connect your Git provider: GitHub or GitLab on every plan, Bitbucket at the Enterprise tier.
- Open a pull request. The review runs automatically on creation, with no prior configuration.
- Re-run a review at any time by typing the /propel command in a pull-request comment.
- Teach the knowledge base one of four ways: state the rule inline with /propel, add it on the knowledge-base page, drop rules into .propel/rules where they are picked up automatically, or attach an existing repository file.
- Name a pull request @auto to have it renamed after its actual changes, or {ticket_number} @auto to prepend the ticket number to the title.
- React to review comments with a thumbs up or thumbs down so Propel adjusts to what your company expects.
- Exclude paths from review with a .propelignore file.
- Connect Slack for notifications and automation triggers and Linear for ticket creation from the dashboard's Integrations page, then tune Review settings and Ticket destination.
- For programmatic use, mint a token with POST /v1/auth/tokens, submit a diff with POST /v1/reviews and collect the result with GET /v1/reviews/{review_id} on the api.propelcode.ai base URL.
Pros & Cons
Pros
- The benchmark figures come from a suite written by a third party, with a published methodology and named competitors, which is rare in this category: Propel influenced neither the choice of repositories and pull requests, nor the labels, nor the other tools' results.
- That benchmark was run without repository-specific tuning, custom rules or historical learning, so it reflects what a team gets immediately after installation rather than after months of training.
- The no-training commitment is written into the Terms, not only into a marketing page, and is echoed by the Security and Enterprise pages.
- Code is processed in memory, retention is announced at under 24 hours and data is purged once the analysis completes.
- The DPA is public and complete, with annexes covering processing details, technical measures, the UK Addendum and four named subprocessors: AWS, Datadog, Sentry and LogRocket.
- SOC 2 Type II is claimed with a publicly reachable Vanta Trust Center, and on-premise or air-gapped deployment answers sovereignty constraints.
- The 30-day trial requires no credit card and opens the full feature set of the chosen tier, backed by public technical documentation with an API reference, a changelog and named customer testimonials.
Cons
- No permanent free plan: evaluation runs through the 30-day trial alone, and Enterprise pricing is never published.
- Prices are displayed by default on the annual cycle ($24 and $64 per developer per month), while the real month-to-month rate of $30 appears only on the Bugbot comparison page.
- Several pages still carry unfinished content: lorem ipsum sits under each of the four knowledge-base methods in the User Guide, the six home-page blocks repeat the first block's sub-list word for word, and three Enterprise blocks share one description under different titles.
- Documents contradict each other: 18 years old in the Terms against a COPPA threshold of 13 in the privacy policy, CA 94111 in the privacy policy against CA 94105 in Annex I of the DPA, TLS 1.3 on the Security page against TLS 1.2 or higher in Annex II, and ISO 27001 mentioned "or equivalent" in the DPA but absent from the Compliance & Certifications page.
- No Article 27 EU representative and no named DPO, while cloud hosting is US-only: EU residency has to go through the Enterprise on-premise route.
- Bitbucket is reserved for the Enterprise tier, there is no mobile app and no browser extension, and monthly pull-request quotas cap Starter at 1,000 and Professional at 10,000.
- A very young product: the domain was registered on 21 March 2025 and first archived on 15 April 2025, so there is no long track record to lean on.
Pricing & Plans
There is no permanent free plan. Access begins with a 30-day trial that requires no credit card and opens the full feature set of the chosen tier. The lowest paid entry point is the Starter plan at USD 24.00 per developer per month, billed annually; the same plan costs USD 30 per developer per month without an annual commitment, the annual cycle carrying a 20% discount. Professional is USD 64 per developer per month on the annual cycle, and Enterprise is quoted on request. Volume discounts are available to enterprise customers, and plan changes take effect immediately with pro-rated billing adjustments.
- up to 50 developers
- basic AI review on foundation models
- GitHub and GitLab integration
- Slack and email support
- basic analytics and the 30-day trial. Capped at 1
- 000 pull requests per month
- with basic security scanning and no custom rules
- no API access
- up to 500 developers
- advanced AI review on frontier models with multiple AI passes
- GitHub and GitLab plus limited integrations
- priority Slack and email support
- advanced analytics
- custom code standards
- security vulnerability scanning
- team performance metrics
- unlimited developers and unlimited pull requests
- premium AI review on the latest models with extensive AI analysis
- every integration including Bitbucket
- a dedicated Slack and email support team
- custom analytics and reporting
- enterprise security scanning
- on-premise deployment
- custom integrations
Data, GDPR & hosting
A consolidated view of how Propel Code handles your data.
GDPR overview
GDPR compliance is claimed in as many words: the Security page promises "Full compliance with the General Data Protection Regulation", and a public Data Processing Addendum dated 4 July 2025 covers Regulation (EU) 2016/679, the UK GDPR and Data Protection Act 2018, the Swiss FADP and the CCPA as amended by the CPRA. EEA-to-US transfers rely on Standard Contractual Clauses, Module Two, under Implementing Decision (EU) 2021/914, with Irish law and courts, the docking clause included and general subprocessor authorization on 15 days' notice; the UK ICO Addendum B1.0 and amended Swiss SCCs complete the framework. Propel undertakes to assist with access, rectification, erasure, portability, restriction and objection requests, and to notify breaches without undue delay. Two gaps: no Article 27 EU representative and no named DPO, legal@propelcode.ai being the only data protection contact.
Who owns the data?
Under the Legal Terms the customer keeps ownership of everything it submits, defined as Your Content: code, files, documentation, data, text, comments and configuration. The customer also owns the Outputs the service returns, meaning suggestions, code changes, analysis reports and review feedback. Propel Platform, Inc. disclaims any rights it might receive in Your Content and states it does not anticipate obtaining any, while retaining intellectual property in the platform itself, its code, design and trademarks. The Data Processing Addendum of 4 July 2025 makes the customer the controller, or business under the CCPA, and Propel the processor, or service provider, contractually barred from selling or sharing personal data.
Reuse rights
Because customers own both their content and the Outputs, review feedback, generated summaries and suggested code changes can be reused freely, with no permission to ask. On the publisher's side, source code is processed in memory inside isolated environments for the sole purpose of producing review feedback, and the Terms forbid the company from training models on Your Content, a commitment the Security page restates as "No Model Training". Beyond the code, Propel collects anonymized usage statistics, performance data on analysis duration and success rates, de-identified error logs and user preferences, plus the personal data listed in the privacy policy of 4 July 2025: name, email, phone number, address, usage data, IP address and device identifiers. Those serve to provide and maintain the service, manage the account, perform the contract, contact the user, share offers, handle requests and improve the product. Data may be shared with service providers, affiliates and business partners, on a corporate transfer or with consent, and signing in through Google, Facebook, Instagram, X or LinkedIn pulls in the corresponding third-party account data. Under the CCPA, Propel states it neither sells nor shares personal data, does not reuse it outside service delivery and does not combine it with data from other sources.
Data retention & training
Hosting summary
Customer personal data is processed and stored in the United States, per section 5.1 and Annex I of the DPA. The infrastructure runs on AWS, deployed across multiple regions for redundancy, with auto-scaling, 24/7 monitoring and a 99.9% uptime SLA; AWS itself maintains SOC 1/2/3 and ISO 27001 for the physical security of its data centers. Propel adds VPC isolation, IAM controls and CloudTrail logging, and runs its AI models in isolated, access-restricted, monitored environments. Four subprocessors are named, all US-based: AWS for infrastructure and hosting, Datadog for logging and monitoring, Sentry for error tracking, LogRocket for session replay. Customers get 15 days' notice before a subprocessor is added or replaced, with a right to object and to terminate without penalty; onward transfers by a subprocessor carry the same safeguards. Encryption is AES-256 at rest and, in transit, TLS 1.3 on the Security page or TLS 1.2 and above in Annex II. Enterprise customers can leave shared hosting entirely for self-hosted, air-gapped or private-cloud deployment.
Where Propel Code works
Country-level availability.
Not available in
Things to keep in mind
Risks and trade-offs to weigh before adopting Propel Code.
- Handing over review judgment: the site itself describes rubber-stamped reviews born of fatigue as the failure mode it fixes, and an AI reviewer trusted blindly reproduces it. Reported recall is 77.8% on critical issues and 50.0% on low-severity ones, so a real share of defects still goes unflagged and a human still has to look.
- Unfinished content is still visible on the site: lorem ipsum under the four knowledge-base methods in the User Guide, the six home-page blocks repeating the first block's sub-list, and three Enterprise blocks carrying the same description under different titles.
- Documents contradict each other on facts that matter: minimum age 18 in the Terms against 13 in the privacy policy; 182 Howard St, Suite 823, CA 94111 in the privacy policy against 182 Howard Street, Unit 823, CA 94105 in Annex I of the DPA; TLS 1.3 on the Security page against TLS 1.2 or higher in Annex II.
- Certification claims do not line up: ISO 27001 appears "or equivalent" in the DPA but is absent from the Compliance & Certifications page, which lists only SOC 2, GDPR and CCPA, and the Vanta Trust Center is a JavaScript-rendered page whose content could not be verified in the static HTML.
- The headline impact figures, 60% faster reviews, 3x more merged pull requests, 50% of pull requests improved and 15 hours saved per engineer per month, carry no published methodology, unlike the benchmark results they sit next to.
- Pricing is presented on the annual cycle by default, and the real month-to-month rate of $30 per developer surfaces only on the comparison page; Bitbucket appears in the comparison table but is ticked for Enterprise alone.
- Governance and model gaps: no Article 27 EU representative is named although GDPR compliance is claimed, no DPO is designated, and the models cited (GPT-4o, Claude 3.5, Gemini Pro) come from the Enterprise page and may have aged.
Setup & Integrations
Technical difficulty
Getting started is easy: create an account, connect GitHub or GitLab, and reviews fire automatically on each new pull request with no prior configuration. The third-party benchmark was itself run with no repository tuning, no custom rules and no historical learning. Customization is optional and incremental: rules in plain English through a PR comment, the knowledge-base page or a versioned .propel/rules file, path exclusions via .propelignore, Slack and Linear enabled from the dashboard. Programmatic use adds a token and REST calls. Only on-premise or air-gapped deployment is a genuine infrastructure project, and professional services cover it.
Deployment
Integrations
Behind Propel Code
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Propel Code.
Frequently asked questions
How does the 30-day free trial work?
Can I change plan later?
What happens if I exceed my pull-request quota?
Is there a discount for paying annually?
Is my code secure?
Is my code used to train AI models?
How long is my code kept?
Which repositories and tools does Propel integrate with?
Is there an API?
Where is the data hosted, and is a DPA available?
Should you pick Propel Code?
Propel Code is a young product, its domain registered in March 2025 and first archived in April 2025, yet it arrives better equipped on security and compliance than its age suggests: SOC 2 Type II, a complete public DPA with four named subprocessors, a contractual ban on model training, and on-premise or air-gapped deployment for teams that need it.
Its strongest argument is also the rarest in this category. The benchmark was written by a third party, run on production open-source pull requests across seven tools, with a published methodology and competitors named; Propel comes out first on F-score, and the test was run with no repository tuning and no custom rules, which is close to what a team sees on day one.
The reservations concern the site rather than the product. Several pages still hold placeholder content: lorem ipsum under the four knowledge-base methods in the User Guide, sub-lists copied verbatim across the six home-page blocks, three Enterprise blocks sharing a single description. Documents also disagree with each other, on the minimum age, on the company's own postal address and on the TLS version in use. None of this is disqualifying, but together it reads like a site shipped ahead of its own copy.
There is no free plan, so evaluation means committing to the 30-day trial, which at least asks for no card and opens the full tier. Hosted data stays in the United States.
The verdict is narrow and clear: Propel Code makes sense for an engineering team that already produces a large volume of AI-assisted code and wants an independent reviewer that did not write it. Teams with a lighter review load should weigh the per-seat price against the hours it would actually save.
- Choosing a selection results in a full page refresh.
- Opens in a new window.