What we see
Only the Pull Request diff and the repository context needed to evaluate it. Never the full repository. AURA human reviewers are not in the flow: processing is automatic.
SECURITY · TEAM TRUST
Your code is not used for training. You set the scope.
The trust you expect from a serious AI code reviewer — and one step further: ephemeral processing, zero code retention, zero training, per-organization isolation, and controls a CTO or CISO can audit from day one. No empty promises.
How long it is retained
Code is processed ephemerally and is not stored after review. We keep findings, verdicts, and metadata for your history and reports. Zero use for model training, by contract.
How it is isolated
Each organization has its own GitHub App credentials and separated data. Admin, Reviewer, and Observer roles. An audit log of every access, exportable.
Operational security
Signed webhooks (HMAC), rate limiting, encryption in transit and at rest, monitoring with Sentry, documented daily backups. WebAuthn authentication available.
Models and region
Automatic routing across three model tiers. On Enterprise — and only on Enterprise — you choose the provider, restrict the processing region, or bring your own API key: your code goes to the provider you choose, under your own contract.
Runtime, on your machine
Runtime runs locally and links to the web with a pairing code and a remote approval window with expiry (12 or 24 hours). Without that active link, no one can approve actions on your machine from outside.
View Runtime metadata →With honesty
The bar of a world-class reviewer. More control for you.
Static analysis + dependencies
Secret detection, injection patterns, personal data in logs, and continuous monitoring of vulnerable dependencies with Dependabot. All inside the security criterion of every verdict.
Security add-on
CVEs matched against your real dependencies with same-day publication alerts, suggested remediation PR, full-repository review, and confirmation of each finding before it is shown. SOC 2 Type I: target Q4 2027.
Active security and self-hosted
Attacking an isolated instance of the code before merge (load, injection) and deployment on your own infrastructure. They are in our product vision. We do not put a date on them until they exist in alpha: we prefer not to promise what we cannot yet deliver.