GitHubDesign partner

SECURITY & TRUST

Architecture, evidence, and plans are different things.

This page labels them separately. Unknown or unverified controls remain visible instead of being promoted into compliance language.

Pre-production trust surface. Security contacts, product control evidence, subprocessors, retention terms, and enterprise documentation remain launch blockers.

CONTROL STATUS

What can be said today

Implemented

This public website

  • Static-generated pages with no authenticated surface or database.
  • No contact submission backend, visitor analytics, advertising scripts, session replay, or non-essential browser storage.
  • Self-hosted fonts and visual assets; no runtime Google Fonts request.
  • Content Security Policy plus transport, framing, referrer, content-type, and permissions headers in the Pages configuration.
In validation

Local product controls

  • Exact release packaging and installation path for the public Alpha CLI.
  • Product-level data-flow, deployment-mode, encryption, logging, and retention statements for customer evaluation.
  • Evidence required before broader security claims are approved for publication.
Planned

Operated services

  • Hosted Answer, Freshness, transition, and fleet service controls.
  • Enterprise access control, audit, retention, incident, and subprocessor documentation.
  • Independent assessment or certification work, if and when completed.
Not applicable

Claims we do not make

  • This website does not receive or analyze visitor repositories.
  • No SOC 2, ISO, HIPAA, penetration-test, uptime-SLA, or “GDPR certified” claim is made.
  • Onboard UX is not observability, incident response, ITSM, production support, or application maintenance.

DATA LOCATION

Keep knowledge in the approved environment

This is the architectural direction. Exact product deployment modes and data flows must be verified before a production promise is published.

ANSWER BOUNDARY

Say known, stale, unknown, or observation-limited

The product story treats evidence limits as output. It does not imply that an assistant can safely extrapolate past what is observed.

EXECUTION BOUNDARY

Do not confuse probes with monitoring

Behavior baselines are scoped, approved checks. They are not production observability, health monitoring, incident response, or application operation.

TRUST DOCUMENTS

Review the boundaries that are ready. See the blockers that are not.

Vulnerability disclosureSubprocessorsDPA status