Trust Center
Everything your security reviewer needs — the honest version: what we do, where data goes, and what we're still building.
Execution isolation
Web sessions run in unprivileged, egress-restricted Firecracker microVMs. The CLI runs locally on your machine.
Where your data goes
Task context is sent to the model (Fireworks/DeepSeek, US) for inference. We don't build separate copies of your repo on shared storage.
DPA & paperwork
Data-processing agreement available for enterprise; we will complete your security questionnaire.
Compliance
SOC 2 is on our roadmap — not yet certified. We state status honestly in every review.
Monitoring & incidents
Prometheus/Alertmanager, health checks, and daily security verifications; documented incident response.
Access control
OIDC login today; SSO (SAML) and SCIM on the enterprise roadmap.
Sub-processors
Model inference: Fireworks AI (DeepSeek model, US). Payments: Stripe. Email: Resend. Hosting: Hetzner (EU/US). Analytics: Plausible. A current list is maintained in our security pack.