Security

The four guarantees#

Zero retention. Isolated per organization. Nothing is shared between tenants.

No training on your data. Your code never trains any model. This holds by contract, not policy, and extends to the model provider. Prompts are discarded after each response.

Least privilege. Only the GitHub permissions the review needs.

Encrypted everywhere. TLS 1.3 in transit, AES-256 at rest.

Isolation model#

Every organization runs on isolated infrastructure. Each organization gets its own storage access point, and workers can only ever mount that organization's code. Your data is reachable only through your account.

Prelint never executes repository code. There is no code-execution environment in the product.

Access#

Nobody at Prelint opens your data unless you ask — not for debugging, not for curiosity. Every access is logged, and the log belongs to you.

If you close your account, your data is deleted and you receive the auditable deletion log.

Subprocessors#

Your data is used for one purpose: providing the service. Every subprocessor that touches it, Amazon included, is on the published subprocessor list and bound by a data processing agreement. Prelint does not sell your data.