Your code is not ours, and most of it we never hold at all.

Your source code is never stored.

No column exists that can hold source, a diff, a patch or a token — retaining one would take a database migration, and a build gate fails any log call that could receive source. On the command-line path your code never leaves your machine at all. On the GitHub App path it is unpacked onto an analysis worker, read inside a sandbox with no network, and deleted when that one analysis ends.

We write to your repository in one place only, and only when you ask.

One instrumentation file, on a branch of its own, as a pull request you review and merge — opened only when you ask for it in MLReps. Nothing else: no push to your default branch, no merge, no second file, no second pull request. A fix is never committed; it stays a patch you apply yourself. The analysis worker that reads your code asks for read access and never holds the write, the commit is made from our web host with a token that names one repository and is revoked before the call returns, and our pull-request check can only report neutral, so it is incapable of blocking your merge.

Nobody is ever ranked.

There is no per-developer score, no leaderboard, and no screen that names who merged what — permanently, by decision. A record readable by whoever writes the performance review stops being true, so the endpoint does not exist rather than being access-controlled.

One organisation can never read another's data.

Every query against a table that belongs to a tenant is scoped to that tenant, and a build gate checks every one of them — not a review habit, a check that fails the build.

Credentials we find in your code are removed before anything leaves the process.

A detector suite runs over anything on its way out, including a key split across a line break, and replaces it whole, so no fragment leaves and no folded line is shown back to you.

In transit and at rest, it is encrypted.

TLS 1.3 everywhere, including between the worker and the control plane; encrypted storage, with per-tenant key separation for the knowledge plane.

Repository names

The full name only — "acme/payments" — for the repositories you selected when you installed the App.

Kept: Until you uninstall, which removes them at once.

Findings and the architecture map

What each rule found, at what severity, and the shapes the report carries: file paths, URL patterns, table, package and operation names, and line numbers. No source text. This is the one thing we genuinely hold at rest, and saying so is the point of this row.

Kept: Until you ask us to delete it. Uninstalling the App does not erase it — see below.

Telemetry you choose to send

Traces and metrics from your running system: the shape of a request, timings, error types and the frames that land in your own files. An exception's message is never read — it is the one field built to hold whatever your code put in it, so it is not decoded at all. Logs are off unless you turn them on.

Kept: 14 days, then swept.

Your account

An email address and a password hash, and which organisation you belong to.

Kept: Until the account is deleted.

That Radh was asked something

Which surface asked, whether there was evidence to answer from, whether an answer was produced, and the token cost. Never the question, never the answer, never a transcript.

Kept: Kept as usage metadata.

Three, and no others. Each one is named because a page claiming it shares nothing with anybody would not be true, and naming them is what should make the rest of this page believable.

GitHub

The App reads your repositories under the scopes GitHub shows you on its own consent screen. It is where your code already is.

Google

When you ask Radh a question, the question and the evidence we assembled for it are sent to Google's Gemini API to be phrased. We keep no transcript of either. We have not independently verified Google's retention of what is sent, and we will not tell you we have.

Amazon Web Services

Hosting for the control plane and the analysis worker.

Google Analytics

On the public pages of this site — never inside the product — Google Analytics receives the address of the page, where you arrived from, and an approximate region. Consent is set to denied before it loads and there is no banner to grant it, so no analytics cookie is stored on your device and nothing links one visit to the next. It does not run on any console or admin screen, on the sign-in page, or on the page a terminal sends you to.

A page that states only the reassuring half is the thing this product exists in opposition to. These are true as well.

Uninstalling does not erase your history.

It removes the connection and your repository names at once, which withdraws our access. Your findings and architecture map stay, deliberately, so that reinstalling next week does not find your record gone. If you want them gone, ask us and we will delete them.

There is no self-serve delete, and no self-serve export.

Both are done by hand on request today. We would rather say that than describe a button that is not there.

Operator access is not yet mechanically blocked.

Our own staff are held to aggregates by how the admin screens are built, and every one is restricted to counts and buckets that cannot name a customer. The stronger control — where reading a specific customer's data requires a time-boxed grant from that customer and is logged where you can see it — is specified and not yet built. Until it is, this is a practice, not a mechanism, and it is listed here instead of being left out.

Write to connect@mlreps.com and we will delete everything we hold on your organisation, or send it to you. Both are done by hand today; neither is a button yet, and this page will say so until it is one.