Your data
Where does my code go?
Atrytone reads your code only after you connect it or upload it. The free check reads it in memory and keeps what it found, never the code. A fix job works on a copy on our server in Vienna and deletes it when the job ends. Any AI work goes to the provider you chose, on your own key.
Last updated
What leaves your repository
- To us. Your code is read only through the GitHub App you install, or the code you upload yourself. The App can read your code and write branches, pull requests and check results. It cannot touch your repository's administration, secrets, actions, workflows or members.
- The free check. The check downloads your repository's latest code once and reads it in memory; nothing is written to a disk. The check itself makes no AI calls.
- A public list of known flaws. To look up known flaws, the check sends the names and versions of the parts your app uses to osv.dev, a public list of known flaws, never your code.
- The AI provider you chose. When a fix is made, your code and your requests go to the AI provider you chose, with your own key, under its terms, not ours. We never run it on a model we pay for.
- Not shown to the AI. Files whose names say they hold credentials, such as .env, are withheld from the model, and the job's log names each one. A key pasted into ordinary code is not caught by its file's name — that is what the night check looks for.
What we keep, and for how long
- After a check. The nightly check keeps only what it found, never the code, and never the value of a secret it found.
- After a fix job. A fix job copies your code onto our server in Vienna, Austria, works on that copy and keeps a snapshot of the files it read and wrote with the job, so a stopped job can carry on. The copy on our server is deleted when the job ends; a daily check removes any copy left behind once it is 14 days old.
- Code you upload. If you upload your code instead of connecting GitHub, the upload is kept on our server in Vienna.
- The record. Everything Atrytone does for you is written into a permanent record that you can read and download. The record is never edited; a correction is a new entry.
Where it is kept
Our server is in Vienna, Austria. Our database, sign-in and file storage are in Frankfurt, Germany.
What we do not do
We never use your code or your data to train an AI model, and we never sell it or use it for advertising. We publish nothing of yours.
How to stop it
Remove the GitHub App from your repository, and nothing can read it again. Press “Ask us to delete my workspace” in Settings, and a person deletes your workspace and your sign-in, after an export.
What is not settled
The privacy note these words come from is still a draft. Read the whole text, and the technical note that backs each line with the mechanism that makes it true.