Security and Privacy

ProdE connects to your Git repositories, builds a searchable knowledge layer from your code, and exposes that knowledge through ProdE Chat, project workspaces, and MCP servers for IDEs and AI coding agents. It is operated by CuriousBox AI Inc.

Because the product's core input is source code, among the most sensitive assets an engineering organisation holds, our security posture is built around one principle:

Your code is processed to build derived intelligence, is never used to train models, and can be deleted by you at any time.

This page covers what most people need to know. For a formal security review we maintain a trust package covering our Data Handling and Protection Policy, Subprocessor Register, Data Processing Addendum, ISO certificate, penetration test summary, and detailed architecture and control documentation. Request it at security@curiousbox.ai.

Certification

ISO/IEC 27001:2022, certified.

Certified scope: Design, development, deployment, operation, and support of an AI-powered platform that analyzes and indexes software repositories to provide intelligent search, automated technical assistance, and AI-driven project management through natural language queries.

The certificate is available on request and can be verified directly with the issuing body. We also commission independent penetration testing on a regular cycle, and can share the report or a redacted executive summary under NDA.

Hosting

ProdE's multi-tenant service runs on Google Cloud Platform in the United States.

For on-premise deployments, all persistent data (code index, embeddings, generated documentation, logs, and uploaded attachments) resides in your own storage. ProdE retains no copy outside your environment, and external telemetry and error reporting are disabled by configuration.

Specifications and architecture detail for dedicated and on-premise deployments are provided during onboarding.

What we process

Where payment card data, health information, government identifiers, or personal data is present inside your repository, it is handled at the same classification as source code.

AI providers and your code

ProdE applies large language models and embedding models to your source code, which means your code necessarily interacts with AI systems. Our commitments:

1. We do not train models on your code. CuriousBox AI does not train, fine-tune, distil, or otherwise develop machine learning models. We consume third-party model APIs. There is no training pipeline for your code to enter.
2. Our AI providers do not train on our submissions. Every provider we use is engaged under enterprise or API terms under which customer data is not used to train provider models.
3. We operate zero data retention with our AI providers. Data collection is disabled and zero-retention terms are in force on our accounts with every provider we use, configured at the account and contractual level. Supporting evidence can be shared on request for the providers enabled in a given deployment.
4. One customer's data is never used to serve another. All derived intelligence is scoped to the tenant and repository it came from.
5. All AI traffic egresses through a single controlled gateway, giving one enforcement point for provider configuration, retention settings, and egress auditing.
6. You own your code and your outputs. We claim no ownership or licence over your source code beyond what is necessary to provide the service, and no ownership of the documentation, answers, or artefacts the platform generates from it.
7. No advertising, profiling, or secondary use. Your data is not sold, not shared for advertising, and not used beyond delivering and supporting the service.

When providers are involved

AI models are used at two points, and only these two send your code to a third-party provider:

Connecting a repository, reading it, analysing it, storing the results, and deleting them all involve no third-party AI provider.

Which providers

Your source code is transmitted to third-party AI providers as part of normal operation. This is inherent to the product: a model cannot answer questions about code it has not been shown. Our protection model is built on who receives it, what they may do with it, and how little is retained, not on pretending it does not happen.

ProdE does not send the entire codebase for every question. It selects only the content relevant to the specific request. Anthropic models are accessed either directly or through Google Vertex AI depending on configuration, and both routes are covered by the commitments above.

Model selection is a platform configuration decision based on capability, latency, and cost, and is not end-user configurable. We do not route customer data to models hosted by any provider outside the list above. New providers are assessed for security, confidentiality, retention, and training terms before engagement, and provider retention settings and training opt-outs are verified periodically rather than assumed from initial setup.

Your own endpoints. ProdE supports Azure OpenAI and Google Vertex AI using customer-provided instances, so inference can run inside your own cloud project and location under your own provider agreement.

Prompt caching. For latency reasons, AI providers may cache prompt prefixes. Where this applies, cached content resides on the provider's infrastructure for the cache lifetime, up to one hour. This is distinct from conversation storage, which is disabled.

Secrets committed to your repositories

ProdE only has access to the repositories you explicitly connect. It does not scan a developer's laptop, local workspace, or unrelated systems.

Where a secret such as an API key or password is committed into a connected repository, it becomes part of the permitted codebase content. As with any code assistant workflow, that content could be included in what is shared with the AI model if it is directly relevant to the question being asked. The mitigations that apply: all transmission is over TLS, providers operate under zero-retention terms and training prohibitions, prompt content is not retained as an operational record, and the platform is instructed not to surface secrets in generated output.

The safest protection is standard practice. Do not commit secrets into source control. Use a secrets manager, environment variables, and secret scanning in CI, and rotate any credential that has been committed historically.

Encryption

All traffic between you and ProdE is encrypted with TLS 1.2 or higher, as is all traffic from ProdE to AI providers and Git providers. Data at rest is encrypted at the infrastructure layer, including production servers and their persistent volumes.

Git provider tokens are never stored in plaintext. Each is encrypted with a per-team key, and that key is itself encrypted under a master key held in a key management service. Tokens are decrypted on demand, in memory, only for the duration of an outbound API call.

Tenant isolation

The hosted service is multi-tenant, with tenants separated logically and the separation enforced at the data layer rather than left to application convention. Derived intelligence is scoped to the tenant and repository it came from, content deduplication is scoped per tenant, and there is no cross-tenant sharing of code or derived artefacts.

If you require physical rather than logical separation, use the single-tenant or on-premise deployment options above.

Repository access

All access is over HTTPS. We do not use SSH deploy keys.

On GitHub, use the App installation or a fine-grained PAT if you want strictly read-only access. GitHub's own permission model requires the broader repo scope for a classic PAT, so the App path is the better choice. All other providers are read-only as shown. See Connect your repositories.

We store no credentials on the machines that clone your code. A short-lived token is requested immediately before each Git operation and the authenticated remote URL is reset afterwards, so no token persists in any local Git configuration. Repositories are re-read on a schedule, and you can also sync manually.

If you want a sensitive repository set kept apart from the rest, connect it to a separate workspace.

How we analyse code

Analysis is static. Source files are read and analysed across all major languages to build a structural understanding of the codebase. ProdE does not run your applications.

To resolve references accurately across files and packages, analysis also uses standard language tooling for dependency and project resolution. This runs inside an isolated container environment, scoped to the repository being analysed, with restricted filesystem access and enforced resource limits.

Uploaded file attachments are scanned for malware before storage.

Who can see your code

Roles. Two team roles: Owner and Member. Owners perform administrative actions such as connecting and removing repositories, managing Git integrations, and workspace configuration. Members use the workspace normally. Only Owners can add or remove repositories or manage integrations. Projects carry their own access controls: private projects are accessible only to users granted access, while public projects follow workspace visibility settings.

Authentication. Google SSO is supported today. For on-premise deployments, customer-enforced OIDC and SAML 2.0 with identity providers such as Okta and Azure AD is supported, including IdP-enforced login.

MCP tokens. Standard bearer tokens have a 6-month lifetime. OAuth-based MCP uses a 1-hour access token with a 6-month refresh token. Tokens are scoped to the authenticated user and workspace, and confer no more access than that user already holds. Server-side revocation is supported at user level or organisation-wide, invalidating tokens immediately without waiting for expiry. Rate limits apply to MCP tool calls.

ProdE personnel. No ProdE engineering personnel have access to customer source code. No CuriousBox AI personnel review your prompts, code, or model outputs as a matter of routine: there is no internal review queue or annotation workflow, and prompt and response content is not retained as an operational record.

Dedicated contact. Each enterprise customer is assigned a point of contact for onboarding, setup, training, and support. Where access is needed to perform those functions, this person is added to your workspace as a standard user, visible in your own user list, subject to the same access controls as any other member, and removable by you at any time.

Retention and deletion

Repository content and the knowledge layer derived from it persist while the repository remains connected, so that ProdE does not have to re-read the repository on every request.

Deleting your data

A team Owner can delete their repository data at any time from the ProdE web application. No support ticket, no email request, no waiting on us.

Deletion is triggered by disconnecting the Git provider integration, and takes effect immediately. Disconnecting an individual repository is a different action: it stops syncing but keeps the parsed data so the repository can be reconnected without a full re-index. See Connect your repositories for both.

Disconnecting the integration removes, for that provider:

• File contents and all derived code metadata, across every store that holds them
• All generated documentation, summaries, and analyses
• All vector representations used for semantic search
• All keyword and documentation search index entries
• The repository records themselves
• Any copy of the source code held within our environment

Deletion is a hard delete. Records are removed, not flagged.

It is scoped to the provider being disconnected, so disconnecting GitHub does not affect Bitbucket, GitLab, or Azure DevOps repositories, and it is keyed to the specific team and repositories concerned. Finer granularity is available for GitHub: an Owner can disconnect an individual GitHub organisation and purge only that organisation's repositories, leaving other connected organisations intact.

Stored Git provider credentials are removed when the integration is disconnected. You can additionally revoke ProdE's access from your own Git provider at any time, which takes effect immediately and independently of anything on our side. Where the GitHub App path is used, removing the installation revokes access directly.

Chat transcripts, generated documents, and project artefacts may draw on repositories across more than one provider, so they are not tied to any single Git integration and are not removed by disconnecting a provider. This content is removed after account closure, or on request.

Retention periods

Deletion of live data does not trigger immediate rewriting of historical backups, which is standard practice and consistent with regulatory guidance. Deleted data ages out of backups within the 90-day window. Backups are encrypted and are not restored into production except in a genuine recovery scenario.

The full retention schedule, including operational logs, billing telemetry, account records, and what happens at the end of a trial or subscription, is set out in our Data Processing Addendum. Cost and usage telemetry records token counts, model, latency, and cost, and contains no source code and no prompt or response content.

Retention may be extended where required by law or to comply with a legal hold. We would notify you where permitted.

In an on-premise deployment, all persistent data resides in your own storage. Deletion can be performed in-product as described above, or by decommissioning the deployment and destroying the underlying volumes and databases according to your own policy.

Contact

We accept responsible disclosure and triage reports directly through security@curiousbox.ai.