Evidence for engineering. Oversight for security.
Connect codebase audits, continuous review, and remediation in a workflow your security team can govern. Start with a scoped pilot and clear criteria for success.
An enterprise evaluation
- Security leadership
- Coverage, ownership, open risk, and verified remediation.
- Engineering
- Code context, reviewable evidence, and proposed patches.
- Procurement
- Data handling, deployment scope, and contracted terms.
Give the pilot a decision to answer.
Measure whether the workflow gives your reviewers useful evidence and fits the way your teams ship.
- 01
Agree on the scope
Choose a business-critical application, repositories, review questions, and authorized environments. Set a baseline for review time and current findings.
Scope, owners, and success criteria
- 02
Evaluate the evidence
Review code traces, reproduction evidence where feasible, proposed fixes, and stated limitations. Compare the effort needed to reach a review decision.
Engineer-reviewed findings and a pilot scorecard
- 03
Plan the rollout
Define access, repository policies, integrations, remediation ownership, and leadership reporting. Confirm deployment and contract requirements before expanding.
Rollout plan and enterprise review
Bring your requirements to the review.
Review access, data protection, deployment, and oversight. Enterprise options and service terms are confirmed for your agreed scope.
Identity and access
Repository-scoped access
Authorize selected repositories and review user and administrator permissions before expanding scope.
Federated identity optionsEnterprise
Confirm the identity provider, protocol, and configured deployment in the enterprise agreement.
User lifecycle reviewEnterprise
Agree provisioning, deprovisioning, session invalidation, and access-review responsibilities.
Revocable MCP keys
Read-only MCP keys are stored as SHA-256 digests and support revocation. Review other credential types separately.
Data protection
Retention by data category
Working copies, caches, findings, resume state, operational records, backups, and provider data need an agreed lifecycle.
Model-provider terms
Agree the provider/account, processing region, training-use restrictions, and retention before granting access.
Credential protection
Onboarding test credentials support authenticated encryption when storage is configured. Confirm other storage and transport protections.
Event and trace boundaries
API event metadata excludes bodies and credential headers; agent/session traces are separate retained artifacts to review.
Deployment and models
Customer-controlled hostingEnterprise
Hosting and infrastructure, access, upgrade, and support responsibilities are scoped by agreement.
Isolated environmentsEnterprise
Review the proposed network, storage, identity, model, and administrator boundaries.
Bring your own model credentialsEnterprise
Confirm providers and account controls. Customer-owned keys alone do not establish private inference or zero retention.
Open-weight model evaluation
Public research used open models. Confirm the proposed endpoints, infrastructure, and supported workflow for your deployment.
Oversight
Administrative event review
Confirm event coverage, access, retention, filtering, saturation behavior, and export for the deployment.
Customer change approval
Agree read and pull-request permissions separately. Keep patch review, verification, and release approval with your team.
Policy and scope controls
Agree review policies, permitted actions, test environments, exceptions, and reporting for the purchased workflow.
Named supportEnterprise
Support, escalation, response targets, and incident-notice terms are confirmed in the contract.
SOC 2 Type II audited
Trust Center
Terms to agree for your deployment
- Code, finding, and patch ownership
- Incident notice and escalation obligations
- Retention, deletion triggers, and backup expiry
- Confidentiality and data-processing terms
- Approved regulated-data scope, including any BAA
- Provider and subprocessor security obligations
Know where to start.
Use the free assessments to identify gaps and establish a shared starting point with your engineering sponsor.