What the server sees

Your code is read on your developers' machines, not here. Claude runs there, with their own login, on a clone they keep. The server never clones a repo.

While a job runs, the server holds in memory: the PR's title and description, its comments, the review or reply the machine sends back, and for a fix the changed files. It posts them to GitHub as the app, then forgets them.

Nothing is stored. There is no database. The logs have links to PRs and comments, and GitHub logins, but no code and no tokens.

Logins: a developer's GitHub token is checked with GitHub to learn who they are and which orgs they are in. Only a hash is kept, in memory, for minutes.

Payment is handled by Stripe. The server never sees card details; it only asks Stripe which orgs have paid, and writes your org's name on the subscription.

The app's permissions: read and write code (to push fixes when asked), pull requests and issues (reviews and replies), checks (to show who works on a PR), and read statuses, actions and members (CI results and team review requests).

Back