Your code never leaves your network.
This is usually the question that decides whether a pilot happens at all — so it is worth being blunt about. Nothing of yours is copied anywhere we control.
On a machine you already have.
You install a small agent on a machine you control — a server in your cloud account, a box in your datacentre, anything behind your own VPN. It is the same idea as a build runner, and most teams already have somewhere obvious to put it.
That machine reaches out to us and asks for work. Nothing ever connects inward. There is no port to open, no VPN account to create for a vendor, and nothing for your network team to sign off beyond ordinary outbound web traffic.
Your checkouts, your build caches and your development credentials live on that machine and nowhere else.
- Does our code leave our network?
No. It is checked out onto machines you own and stays there.
- What access do you need to our systems?
None. The machine reaches out to us; we never reach in.
- Do we open a firewall port?
No. No inbound rules, no VPN access, no address ranges to allowlist.
- Can it reach our internal services?
Yes — it is inside your network, so it reaches whatever that network reaches.
- What if we want it gone?
Uninstall the agent. Nothing of yours was anywhere else.
It can reach the things that make work possible.
Your builds actually run
Real machine, real toolchain. It compiles, runs your test suite, spins up the containers your tests need, and installs from your internal package feeds.
Your test data is reachable
The development database that only resolves inside your network is exactly where it needs to be. Nothing has to be copied out to make it usable.
It gets faster as it goes
It keeps the checkout and build caches between jobs, so the second ticket on a repository is quicker and cheaper than the first.
Most AI coding tools fail here rather than on intelligence. If it cannot build and test your code, it cannot know whether its own work is correct — and you are back to reviewing guesses.
Even on your machine, its reach is narrow.
Being on your infrastructure is not the same as having the run of it. What the agent can actually do is deliberately small, and the limits are enforced by your own systems rather than by asking it nicely.
The clearest example: it can push a branch and open a pull request, but it cannot merge one. Your own branch protection stops that, and we check the protection is in place before you can even finish setting a repository up.
Anything in the second half of that list is only ever done after a person approves it, and it happens on our side rather than on your machine — so the credentials for it are never sitting somewhere an agent could reach.
Put your security team on the call.
We would rather answer the hard questions in the first week than the ninth. Most of them have a one-sentence answer, and the ones that do not, we will say so.