Explanation
Data governance
What happens to your code — never used for training, analyzed in volatile memory, encrypted at rest.
Three promises up front — the questions every CTO asks before connecting a repo:
What we store — and what we don't
| Data | Handling |
|---|---|
| Your source / diffs | In memory during a review, then discarded — not persisted |
| Findings & verdicts | Stored against the PR so reviews are reproducible |
| Provider tokens (PAT, webhook secrets) | Encrypted at rest (AES-256-GCM), never returned to the client |
| AI keys (BYOK) | Encrypted at rest; used only to call your model |
Bring your own model (BYOK)
For maximum sovereignty, point codingassist.bot at your own AI key — your code is then reasoned over by a model you control. See Bring your own model.
Isolation
Every organization is a separate tenant with its own data boundary. See Multi-tenancy & isolation.
Related
Was this page helpful?