Trust Center
Everything your security reviewer needs — the honest version: what we do, where data goes, and what we're still building.
Execution isolation
Web sessions run in unprivileged, egress-restricted Firecracker microVMs. The CLI runs locally on your machine.
Where your data goes
Task context is sent to the model (DeepSeek V4 Flash via Fireworks AI or OpenRouter) for inference. We don't build separate copies of your repo on shared storage.
DPA & paperwork
Data-processing agreement available for enterprise; we will complete your security questionnaire.
Compliance
SOC 2 is on our roadmap — not yet certified. We state status honestly in every review.
Monitoring & incidents
Prometheus/Alertmanager, health checks, and daily security verifications; documented incident response.
Access control
OIDC login today; SSO (SAML) and SCIM on the enterprise roadmap.
Sub-processors
Model inference: Fireworks AI and OpenRouter (DeepSeek V4 Flash). Payments: Stripe. Email: Resend. Hosting: Hetzner (web app microVMs) and DigitalOcean (website and billing). Analytics: Google Analytics (website only). A current list is maintained in our security pack.