Privacy Policy
Last updated: August 2026
The free CLI
Your source code and the evidence aletheore scan produces stay on your
machine. Evidence is written to .aletheore/ in the repository you scanned;
nothing about your code, your repository, or your identity is transmitted. The CLI makes
no network calls of its own and reports no usage data.
If you use an AI-assisted audit command, evidence, not source code, is sent to whichever LLM provider you configure, using your own API key.
The GitHub App (Aletheore Flash and AIR)
Installing the GitHub App is a different trust boundary, and source code does reach our servers.
We clone your repository to run a scan. For repositories we scan repeatedly, a working copy is kept on our scan worker between scans rather than deleted after each one - this is what lets a later scan process only what changed instead of starting from nothing every time. That copy is deleted when you uninstall the app or request deletion, and is not retained after either.
What is stored long-term is derived evidence: secrets findings, dependency graphs, endpoint health rows, and generated documentation.
What we send to our LLM provider depends on the feature, and one of them is not evidence:
- Flash review (automated pull request review) sends the pull request's diff - that is your source code, for the changed lines - along with limited surrounding file context. For paid installations, that diff is also kept for up to 30 days in a short-lived cache, so a near-identical diff doesn't get re-reviewed from scratch; it is deleted automatically once that window passes, or immediately on uninstall. Free-tier reviews are never cached - nothing about them is retained beyond the request itself.
- Managed audits and AIRview send derived evidence, not source code.
Our provider is OpenAI (GPT-5.6 Luna), using our shared key, with an automatic fallback to DeepSeek if OpenAI is unavailable.
What we store
For paid installations: your GitHub account or organization identity, the email address on your GitHub account, evidence snapshots from scans, findings you have dismissed, an audit log of administrative actions taken on your installation, signed audit reports, and, if configured, a Slack/Teams webhook URL and health-check monitoring settings.
Health-check results are private to your dashboard unless you explicitly turn on the public status API for your installation, which is off by default.
We do not sell this data or share it beyond the service providers necessary to run Aletheore: our LLM provider for the features listed above, our payment provider for billing, and our email provider for transactional mail.
Deleting your data
Uninstalling the GitHub App erases everything held for that installation, including the retained working copy of your repository. The same erasure is available on demand from your dashboard without uninstalling. Both paths remove account-level records - your captured email address and any active sessions - once you have no other installation remaining.
Contact
Questions about this policy or a data deletion request: support@aletheore.com