Security

Your code never passes through our servers for semantic analysis

The architecture is pull-based: when the content of your code needs to be read (real documentation quality, navigability, business rules), it is your own AI agent (Claude Code, Codex, Cursor…) that analyzes it on your machine or in your CI, with your credentials, and sends us only structured results over MCP. We compute only mechanical signals over metadata.

The temporary clone

To read the git history, ingestion clones your repo into a temporary directory with an ephemeral read-only token. The directory is always deleted when it finishes (even on errors) and the token is never persisted nor appears in logs (errors are redacted before being stored).

Credentials

• GitHub: we use an App with short-lived installation tokens (~1h); we store no long-lived secrets.
• Bitbucket: refresh tokens are encrypted at rest (AES-256-GCM).
• MCP tokens: we store only their hash; the value is shown once.
• Passwords: bcrypt hash. Social login tokens: not persisted.
• Webhook secrets: encrypted at rest; signatures verified in constant time.

Isolation

Every workspace is an isolated tenant: its repos, analyses, and tokens are not visible to others. All reads and actions are authorised server-side against your membership.