Security & trust

Entelligence AI reads your pull requests, incident history and agent sessions to do its job. This page states what we do with that access. We do not train on customer code, secrets are encrypted at rest, and the product is SOC 2 Type II audited annually. Ask us for the latest report at security@entelligence.ai.

Compliance

SOC 2 Type II, audited annually against the Trust Services Criteria for security, availability and confidentiality. The current report, scope and bridge letter are available under NDA on request.

What we commit to

• We do not train on customer code. Customer code is used only to deliver review and insights for your organization. It is not used to train models and it is not retained after the review completes.
• Isolated review execution. Every review runs in its own environment. No state is shared between runs or between customers.
• Secrets are encrypted at rest. Repository credentials, provider keys and integration tokens are encrypted at rest.
• Role-based access in the CMS and product admin surfaces. Workspace controls cover review roles, repository access and connected destinations.
• Self-hosted deployment. Run Entelligence inside your own network so code never leaves it. Architecture, storage and deployment commitments are reviewed with you during rollout.
• Bring your own keys. Route model calls through your own provider accounts. Usage is billed by your provider, not marked up by us.

Metrics are not surveillance

Engineering signals in the product are diagnostic, not a score for individuals. Engineers see exactly what leaders see.

Reporting a vulnerability

Email security@entelligence.ai. Our disclosure contact is also published at /.well-known/security.txt. Please include reproduction steps; we acknowledge reports and keep you informed through to a fix.