Where things run
Your code, your credentials and your model spend stay on hardware you own.
What we run, and what we deliberately do not.
What leaves
The complete list of data that crosses from your network to ours, and the
much longer list of what never does.
Sub-processors
Every third party involved, what reaches them, and why.
Retention
How long anything is kept, including the parts we have not finished
negotiating.
The short version
Your source code never reaches our servers. Agents execute on a machine you own, using the tool logins already on it. We hold no credential to any of your repositories — not a token, not a key, not an app installation. We cannot clone your code, and we could not hand it to anyone who asked. Model spend for the actual work is yours, on your key, from your machine. Prompts containing your source, and the completions that come back, egress from your hardware directly to whichever model provider you have configured. They do not transit us. One thing does leave, and it is one sentence long. The text of a message addressed to your agent in Slack — or a Linear issue’s title and description — is sent to a classification model so we can decide whether the message is work at all. Nothing else goes with it: no identifiers, no repository contents, no diffs, no prompts, no completions. The detail is here, because a reviewer should not have to take a summary on faith.What we would rather you read than discover
This section states the parts that do not flatter us — an isolation boundary that is weaker than we would like on some hardware, a credential model that trades blast-radius control for not duplicating your tooling, and a retention term we have chosen not to pay for yet. They are on Known gaps and Retention. Finding those during a security review is worse for both of us than reading them here.Something missing, or something that reads as evasive? Write to
support@agentick.xyz. A question a buyer had to
ask twice is a page we have not written properly.