Trust center
Understand and control external data transfer before the first transfer.
Deterministic-only runs contact no model provider. They produce sealed evidence, scorecards, and dependency maps.
When external inference is enabled, redacted source excerpts, repository inventory, and PR context go to the selected provider shown in the run manifest (Groq, OpenAI, Anthropic, Google, Moonshot, or DeepSeek) solely to generate explanations, workflows, and drafts. Secret scanning reduces risk but cannot guarantee complete removal. API keys are stored encrypted, shown only as the last 4 characters, and never logged.
Every run records provider and model identity plus the privacy decision in its admission manifest.
You can also bring your own provider key in Settings → AI models. Personal keys are validated before storage, encrypted with AES-256-GCM, and can be re-validated or deleted at any time. Runs made with a personal key use your own provider quota and are still usage-metered.
Immediate revocation: access removed and new processing stopped at request time.
Active-system deletion: primary and derived stores purged promptly with a completion record.
Backup expiry: backups age out on the hosting schedule and are never restored for deleted tenants.
Legal records: only minimal non-content billing metadata, if required.
Privacy, terms, DPA, subprocessors, retention, security overview, and disclosure contact ship in docs/legal.
Manage repository connections, sessions, and recent security activity from Settings.