Security

Transport and data protection

All traffic is encrypted over HTTPS (TLS). Both agent-to-server sync and admin dashboard access are protected from interception and tampering.

• Signed session cookies: the cookie used to keep you signed in is cryptographically signed, so tampering is detectable.
• CSRF protection: all POST requests are validated with an itsdangerous-based token.

Authentication

To protect your account, we support multiple authentication methods.

• Password hashing: passwords are stored as bcrypt hashes. Plaintext passwords are never stored.
• Social sign-in: OAuth 2.0 with Google, GitHub, and X (formerly Twitter). Password management is offloaded to those providers.

Anonymization for social share

When sharing an Insight on X, an optional AI-based anonymization step rewrites sensitive text before it leaves the product.

• Automatic rewrite: Claude Haiku 4.5 replaces person names with "user", company names with "organization", repositories with "project", and file paths with generic placeholders.
• Preview before share: the anonymized text can be reviewed before it is posted.
• Token-based share link: each share URL carries a unique token; only holders of the link can access the page.

Data storage and handling

The data we collect is managed as follows.

• Storage: SQLite-backed databases on the server.
• What we collect: prompt history, usage statistics (sessions, messages, active time), risky signals (secret exposure, risky commands), and diagnosis results (Insight).
• Access control: an organization's data is readable only by that organization's admins; cross-organization access is not possible.

See the Privacy Policy for details.

Hosting

By default the service is hosted by Renue, Inc. on Microsoft Azure (Japan region). Data is processed and stored in a Japanese data center, so it does not cross borders by default.

For self-hosting, we provide a Docker image and can help with deployment. Please contact us if interested.