The free CLI
Your source code and the evidence aletheore scan produces stay on your
machine. Evidence is written to .aletheore/ in the repository you scanned,
and a scan never uploads your source code. The CLI reports no usage data.
The CLI does contact a few services on its own. By default a scan looks up public
advisory and license data for your dependencies, which sends dependency names and
versions (not your code) to OSV.dev and to the package registries;
--no-check-vulnerabilities and --no-check-licenses turn those
lookups off. It also checks PyPI for a newer release; ALETHEORE_NO_UPDATE_CHECK=1
turns that off.
If the CLI itself crashes, it sends a crash report to our error-tracking provider,
Sentry: the exception details and stack trace, the Aletheore, operating system and
Python versions, and recent log lines, with your home directory replaced by
~ and command-line arguments, the machine name and local variables removed.
An exception message can still name a file or path from the project you were scanning.
Nothing is sent unless the CLI crashes. Crash reporting is on by default;
aletheore config crash-reporting off (or ALETHEORE_CRASH_REPORTING=0)
turns it off.
Some optional commands send data to an LLM provider you configure, using your own API key.
An AI-assisted audit command sends evidence, not source code. Asking a question with
aletheore query answer does send code: your question and the most relevant
chunks of your source code go to that provider.
Building the semantic search index with aletheore index turns chunks of your
source code into embeddings. By default that happens on your machine, through Ollama. If
Ollama is unavailable, the CLI can use OpenAI's embeddings API with your own key instead,
but only after you agree to it. If you are logged in with an Aletheore token
(aletheore login or ALETHEORE_API_TOKEN), the chunks, and the
questions you search the index with, are sent to Aletheore's hosted embedding service,
which returns the embeddings and does not store the code or the questions. The service uses an
embedding provider to compute them, named under the GitHub App section below.
aletheore logout (or unsetting ALETHEORE_API_TOKEN) keeps
indexing on your machine.
The GitHub App (Aletheore Flash and AIR)
Installing the GitHub App is a different trust boundary, and source code does reach our servers.
We clone your repository to run a scan. For repositories we scan repeatedly, a working copy is kept on our scan worker between scans rather than deleted after each one - this is what lets a later scan process only what changed instead of starting from nothing every time. That copy is deleted when you uninstall the app, remove the repository from the app's access, or request deletion, and is not retained after any of them.
What is stored long-term is derived evidence: secrets findings, dependency graphs, endpoint health rows, and generated documentation.
What we send to our LLM provider depends on the feature, and three of them are not evidence:
- Flash review (automated pull request review) sends the pull request's diff - that is your source code, for the changed lines - along with limited surrounding file context. For paid installations, that diff is also kept for up to 30 days in a short-lived cache, so a near-identical diff doesn't get re-reviewed from scratch; it is deleted automatically once that window passes, or immediately on uninstall. Free-tier reviews are never cached - nothing about them is retained beyond the request itself.
- AIRview Docs (generated API documentation) sends the source of individual public functions and classes - that is your source code - to write a short description of each one.
- Managed audits and the rest of AIRview (the wiki and the dependency graph) send derived evidence, not source code.
- Endpoint health fix suggestions send a short snippet of the surrounding code (about 30 lines) for a failing endpoint, along with its method, path, and status - that is your source code, to suggest a fix.
For paid (Flash and AIR) installations, our provider for Flash review is IndieRouter (GLM-5.3-Flash), which does not retain prompts or use them to train models, per IndieRouter's own published policy. If IndieRouter is unavailable, Flash review falls back to OpenAI (GPT-5.6 Luna), then DeepSeek.
Managed audits, the AIRview wiki, and AIRview Docs are written by DeepSeek V4.1 Flash via IndieRouter, which does not retain prompts or use them to train models, per IndieRouter's own published policy. If IndieRouter is unavailable, managed audits and the wiki fall back to DeepSeek directly, and Docs falls back to OpenAI (GPT-5.6 Luna), or to DeepSeek if OpenAI is also unavailable.
Endpoint health fix suggestions are written by GLM-5.3-Flash via IndieRouter, under the same no-retention policy. If IndieRouter is unavailable, this falls back to OpenAI (GPT-5.6 Luna), or to DeepSeek if OpenAI is also unavailable.
Free (Community plan) Flash review does not use IndieRouter. It runs through a different set of providers, tried in order until one succeeds: Groq, Google (Gemini), OpenAI's free-tier allowance, then OpenRouter.
Paid installations also use an embedding provider. Embedding turns text into a list of numbers, so that a near-identical pull request diff or documentation packet can reuse an earlier result instead of being reviewed again, and so the hosted search index can find relevant code. The text embedded is the pull request diff for Flash review (your source code, for the changed lines), derived evidence for AIRview, and, if you use the hosted search index, the chunks of source code and the questions described under the free CLI above. Our embedding provider is DeepInfra (Qwen3-Embedding-8B). Per DeepInfra's own published documentation, it does not write API inputs to disk or use them to train models, and its privacy policy says it will not store, sell or train on this data without explicit consent. DeepInfra may process data outside your jurisdiction. Free (Community plan) Flash review does not use it: those reviews are never cached.
What we store
For paid installations: your GitHub account or organization identity, the email address on your GitHub account, evidence snapshots from scans, findings you have dismissed, an audit log of administrative actions taken on your installation, signed audit reports, and, if configured, a Slack/Teams webhook URL and health-check monitoring settings.
Health-check results are private to your dashboard unless you explicitly turn on the public status API for your installation, which is off by default.
We do not sell this data or share it beyond the service providers necessary to run Aletheore: our LLM provider and our embedding provider for the features listed above, our payment provider for billing, our email provider for transactional mail, and our error-tracking provider, which receives technical error reports from our servers (stack traces and error messages, with request data and local variables removed; a message can still name a repository or installation).
Deleting your data
Uninstalling the GitHub App erases everything held for that installation, including the retained working copy of your repository. The same erasure is available on demand from your dashboard without uninstalling. Both paths remove account-level records - your captured email address and any active sessions - once you have no other installation remaining.
Removing a single repository from the app's access deletes our retained working copy of it. The evidence and findings already derived from that repository are hidden from your dashboard and kept until you uninstall the app or request deletion.
Database backups are taken daily and the 14 most recent are kept, so erased data can remain in a backup for up to about two weeks before it is overwritten. We also keep a permanent record that a deletion took place - the installation ID, the account name, who requested it, and counts of what was removed - and nothing else.
Contact
Questions about this policy or a data deletion request: support@aletheore.com