Written for the review, not around it.
Everything below is something the product makes true, not something we are asking you to trust. Where a control is weaker than it sounds, this page says so.
Short answers first.
Where does our code go?
Onto machines you own, inside your network. It is never copied anywhere we control.
What access do you need to our systems?
None. The machine connects out to us. Nothing connects in — no ports, no VPN, no allowlists.
What can the agent actually do?
Push a branch and open a pull request, for about an hour at a time. It cannot merge one.
Can it deploy, or spend money?
Not by itself, and not from your machine. Both need a person to approve them first.
How do we stop it touching production?
You set that, per team and per repository. It is a setting, not an instruction it might ignore.
Could our code train a model, or reach another customer?
No. Nothing you give us crosses to another customer, including anything it learns.
What happens if we leave?
Your data is encrypted with keys only you have. We destroy the keys, which destroys the data.
Can we see what it did?
All of it, live or afterwards — every command, every change, who approved it, and what it cost.
What is in place.
Your existing identity provider. Nobody manages a second password, and removing someone removes their access.
Four roles, grantable for the whole organisation or one team. Who can approve what is part of it.
Enforced in the database itself rather than by application code, so an unscoped query is not possible.
Under keys unique to you, tied to your account, so the same data cannot be read under anyone else's.
Narrow and time-limited where they exist at all. The powerful ones never reach your machines.
The audit trail is the same record the system works from, so it cannot disagree with what happened.
What the agent can hold, exactly.
“It holds a token that lasts about an hour, works on one repository, and can push a branch but not merge it. It cannot deploy, cannot spend past its budget, and cannot contact a customer — because of what the token is allowed to do, not because we asked it nicely.”
The shorter claim — “the agent never holds credentials” — is what most vendors say, and it is not true of anything that can genuinely build and test software. Something that cannot install a package or reach a test database is not much use.
So the control is what the credential can reach, and it is enforced by systems you already run. Your own branch protection is what stops a merge — and we check it is switched on before you can finish connecting a repository.
- stated deliberatelyA stolen token still works until it expires
Within its limits: one repository, branch only, about an hour. It still cannot merge or reach anything else.
- stated deliberatelyA budget can be spent up to its ceiling
The ceiling is the protection. Nothing prevents it from using what you allowed it.
- stated deliberatelyNetwork rules are yours, not ours
The machine is on your network, so what it can reach is your network policy. We record which machine did what; we do not pretend to firewall it for you.
- stated deliberatelyJobs on one machine share a workspace
Two jobs on the same repository and machine can see each other's files. A deliberate trade for speed. Different customers can never share one.
Shared, or entirely your own.
You are one customer on a shared service, separated in the database and encrypted under keys that are yours alone. The work still only ever happens on your own machines. This is the default, and it is the same setup we run ourselves.
The whole thing in your own cloud account. It is the same product rather than a different one, which is what stops the dedicated version from being the less-tested version. Where you need physical separation, that is available too.
On certifications: ask, and we will tell you exactly where we are on whichever framework you need, rather than putting a badge on a page. If a specific one gates your procurement, raise it early and we will be straight with you about timing.
Send this to your security team.
Then send us what they come back with. We would rather answer the hard questions in the first week than the ninth, and the product was built expecting them.