Your code stays yours.
Where it is stored, who processes it, and what we never do with it.
The short version.
Six things that hold for every workspace.
01 · Stored in the EUYour code and its analysis live on Google Cloud in the EU.
02 · Never used for trainingNot by us, and not by the model providers we use.
03 · Zero data retentionOpenAI and Anthropic process the code and text we send without storing it.
04 · Traces kept 30 days at mostPrompts and responses are kept only to support you, then deleted.
05 · You set the scopeSkip a repository or path and we never read it. Index a path without reviewing it, or turn review off per repository.
06 · Integrations are opt-inSlack sees nothing until you connect it.
Where your code goes.
From your repository to a review comment, and every stop on the way.
01 · Your repositoriesOnly the repositories and paths you select.
GitHub02 · Isolated analysisYour code is compiled into a model in an isolated runner.
EU03 · Encrypted storageThe model and its analysis, encrypted at rest.
EU04 · Model providersOnly the excerpts a review needs, under zero data retention.
OpenAI EU · Anthropic global05 · Your pull requestFindings and check results, posted where you work.
GitHub · Slack
Prompts and responses are kept for at most 30 days, only to troubleshoot and support your account, and then deleted. Neither we nor the model providers train on them.
How we protect it.
The measures in our Data Processing Agreement, in plain words.
01 · AccessSign-in through GitHub or Google. Workspace roles decide who sees and changes what.
02 · EncryptionTLS 1.2 or higher in transit, and encrypted at rest on Google Cloud.
03 · IsolationCode is analysed in isolated runners that never connect to our database.
04 · Staff accessWe only open your workspace when you invite us, when a security incident requires it, or when the law does.
05 · ProductionThe production database is reachable only through our internal VPN, with point-in-time restore and deletion protection.
06 · Incident responseA documented incident response plan. We notify you within 48 hours of becoming aware of a breach that affects your data.
07 · Change reviewEvery change to Abstraction goes through automated and manual review before it ships.
08 · Data minimisationThe service is built to process as little personal data as it needs.
How long we keep it.
Only as long as it serves you.
01 · While connectedYour code model and its analysis are kept for as long as the repository is connected.
Until disconnected02 · Interaction recordsPrompts and responses are kept for at most 30 days, only to troubleshoot and support your account.
Up to 30 days03 · After you leaveYou can export your output for 30 days. After that we delete your data, from backups too, as set out in our Data Processing Agreement.
30 days to export
Who else processes it.
Each provider is bound by a data processing agreement with us.
- Google Cloud Hosting, storage and code analysis EU
- OpenAI AI model inference, with zero data retention EU
- Anthropic AI model inference, with zero data retention Global
- Grafana Labs Observability and logging EU
- Resend Transactional email, such as invitations US
Contracts and contacts.
Self-hosted deployments are available under a separate agreement.
- Security
- security@abstraction.com Report a vulnerability or a security concern.
- Privacy
- privacy@abstraction.com Data protection questions and data subject requests.
- Legal
- legal@abstraction.com Contracts, notices and a signed copy of our Data Processing Agreement.
ABSTRACTION
2026
Abstr AB · Org. no. 559512-2739
contact@abstraction.com