Where your code goes when Veridu checks it.
Veridu sees only what a review needs, runs it in a sandbox with no internet access, and keeps as little of your code as it can. The full detail is on the data handling page.
Checks from your agent and pull request reviews run in an isolated sandbox in AWS with no internet access. For a pull request, the repository at the pull request's commit is packed into an encrypted temporary file in Amazon S3, which the sandbox downloads to trace what the change affects. The file and the sandbox's copy are deleted when the review finishes, and a one-day bucket lifecycle rule is the backstop for any file a failed delete leaves behind.
When your agent calls verify_change, it sends the diff and the full content of the files it chose to send. Nothing else from your machine or repository is read.
The prompts, the diff and the related code the tracing found go to OpenAI and Anthropic through Veridu's API access. Under their published API policies, neither uses API traffic for training. Veridu never trains on your code.
The diff and files your agent sent are deleted 7 days after the check. The reviewer models' raw responses and the record of what they looked at are deleted after 30 days. The result and its findings, which can quote lines of your code, are kept until you ask to delete them.
The GitHub App asks for repository contents (read), metadata (read), pull requests (write, to post the review), issues (write, for the pull request comment), checks (write, for the Veridu check) and the account email (read). It reviews only repositories you install it on and then link. A fine-grained personal access token, if you use one instead, is encrypted with an AWS KMS key and deleted when you remove the repository.
Reviews of private repositories are visible only to you and your designated collaborators. Reviews of public repositories are public: anyone with the link can read the verdict and findings, never your account, costs or raw model output.
The CLI's --local mode runs the review on your machine with your own OpenAI and Anthropic keys. Nothing reaches Veridu's servers; your code goes only to those providers, under your own accounts.
Where is the data stored?
AWS us-east-1, in RDS MySQL, encrypted at rest. Connections to veridu.io and the Veridu API use TLS.
How do I delete a review or my account?
Email hello@veridu.io with the review's link, or use Billing → Danger zone for the whole account. Both are handled by hand within one business day; self-service deletion is not available yet.
Does my agent hold a password or key for Veridu?
No password: sign-in is OAuth in your browser with GitHub, Google or an emailed code. Your agent holds a token, and Veridu stores only a hash of it.
Who operates Veridu?
T3 Interactive LLC. Questions about your data go to hello@veridu.io.
The free tier covers public repositories and checks from your agent. See pricing for private repositories.