Security
Security and data handling
What we do with your code and data, in plain terms. This page describes controls that exist today; where something is not in place yet, it says so.
Last updated 20 October 2026.
Your code and AI
Code and configuration from client repositories are processed only by AI models on servers we operate.
Details →Access
There are no passwords: sign-in uses one-time email links or your company's single sign-on.
Details →Integrations and credentials
Access tokens and secrets you give us are encrypted before they are stored, and are never shown again.
Details →Your code and AI
Client code goes only to models we operate
Code and configuration from client repositories are processed only by AI models on servers we operate.
- Enforced in code. Tasks that contain client code cannot be sent to an external AI service unless an engagement is explicitly configured for it after the client agrees in writing.
- Most of the work needs no AI. Deterministic tools (codemods and rules) do most of the work. Every AI rewrite must pass automatic checks before a person reviews it.
- Every change is a pull request. Changes reach your repository as pull requests that your team or ours approves.
- The free scan stays in your browser. The readiness scan runs in your browser; files are not uploaded.
Audit trail
A log you can verify yourself
Every portal action and every AI call during an engagement is recorded.
- Append-only and hash-chained. Each entry includes a SHA-256 hash of the previous one, so edits or deletions are detectable.
- Exportable. Workspace members can download the trail as CSV or as JSON with the hash rule, and verify the chain themselves.
- Streamed to your SIEM. Workspace owners can stream audit events to their own Splunk HTTP Event Collector as they happen; missed deliveries are retried.
Access
Sign-in through email links or your identity provider
There are no passwords: sign-in uses one-time email links or your company's single sign-on.
- Single sign-on. OpenID Connect (Okta, Microsoft Entra ID, Google Workspace) or SAML 2.0. Your domain can be set to require single sign-on.
- Checked on every request. Every portal request checks that the user belongs to the workspace; integration and connection settings need a workspace owner.
- Hashed tokens. Sign-in tokens and sessions are stored as hashes; session cookies are HTTP-only.
Integrations and credentials
Credentials encrypted, webhooks signed
Access tokens and secrets you give us are encrypted before they are stored, and are never shown again.
- AES-256-GCM. Applies to Git hosts, Jira and Confluence, Adobe Cloud Manager, Slack or Teams webhooks, Splunk tokens and identity provider secrets.
- Verified GitHub installations. GitHub access will go through our GitHub App, which is being set up; we verify with GitHub that an installation belongs to the person connecting it. Adobe Cloud Manager access is read-only.
- Signed webhooks. Webhooks from GitLab, Azure DevOps and Bitbucket use a separate secret per connection; webhooks we send to you are signed with HMAC-SHA256 and a timestamp.
- No internal network access. Requests to addresses you supply are checked so they cannot reach private or internal networks.
Not in place yet
What we cannot claim today
- No third-party certification (such as SOC 2 or ISO 27001) and no external penetration test so far.
- We make no data-residency commitment on this site yet.
Security questionnaires and questions
Send them to [email protected].