Least access, granted in stages
Every integration starts read-only and narrowly scoped. Publishing tasks and pushing branches are separate grants, requested later, and either can be refused without losing the rest of the product.
Security
You are connecting us to your source code. Here is exactly what happens to it.
Steelax asks for serious access, so it owes you a serious answer about how that access is used. This page is written to be read by the engineer who has to sign off on it, not by a procurement form.
Principles
Four commitments the architecture has to honour.
These are not aspirations. Each one is a constraint we build against, and each has a concrete mechanism behind it further down this page.
Isolation by default
The coding agent runs in a container created for one task and destroyed when that task ends. No shared filesystem, no shared network, no persistence between runs or between customers.
Your content is not training data
Your code, documents, tickets and conversations are never used to train or fine-tune any model, ours or a vendor's. This is contractual, it applies on every plan, and there is no setting that changes it.
Everything leaves a trace
Every file the agent reads, every command it runs and every change it proposes is recorded in a run log your admins can read and export. Automation you cannot audit is automation you cannot trust.
Data handling
What we store, and for how long.
The short version: we store the minimum needed to answer questions quickly, and we do not keep copies of your repository lying around after a run.
| Data | Stored | Retention |
|---|---|---|
| Source code | Not stored. Fetched into a run environment, held in memory and on ephemeral disk | Destroyed with the container at the end of the run |
| Code index | Structural metadata and embeddings, encrypted, scoped to one workspace | Until you disconnect the repository, then deleted within 7 days |
| Issues and documents | Indexed text and metadata from the projects and spaces you share | Until you disconnect the source, then deleted within 7 days |
| Sessions and generated tasks | Stored so work remains traceable to the reasoning behind it | Your workspace retention setting, 90 days to indefinite |
| Agent run logs | Commands, files touched, test output | 12 months, exportable at any time |
| Access tokens | Encrypted with per-workspace keys in a managed secret store | Until revoked by you or rotated by us |
| Account and billing records | Names, work emails, plan and invoice history | As required for tax and accounting obligations |
Deleting a workspace removes indexes, sessions, tasks and logs within 30 days, including from backups on their normal rotation. We will confirm the deletion in writing if you ask.
Agent isolation
Every run gets its own disposable environment.
When you hand a task to the coding agent, Steelax creates a fresh container, issues a short-lived credential scoped to that one repository, and clones the code into it. The agent works there and nowhere else.
Network access from inside the container is restricted to your repository host and the package registries your project already declares. There is no general outbound internet access, which means code cannot be posted anywhere by accident or otherwise.
- One container per task, destroyed when the run ends
- Credentials expire with the run and cannot be reused
- Egress restricted to your host and declared registries
- No access to default or protected branches at any time
- Full command and file log retained for 12 months
create container run-4b19c
issue token scope=repo:payments-service ttl=45m
egress allow: git host, npm registry
egress deny: everything else
clone payments-service @ main
run task CHK-413
push branch fix/checkout-idempotency
revoke token
destroy container, wipe volume
Access control
Who can do what inside your workspace.
- Single sign-on
- SAML 2.0 and OpenID Connect on the Scale and Enterprise plans, with enforced SSO available so password login can be disabled entirely for your domain.
- Directory provisioning
- SCIM provisioning and deprovisioning on Enterprise, so removing someone from your identity provider removes their Steelax access in the same action.
- Roles
- Admin manages integrations, members and retention. Member asks questions, shapes work and generates tasks. Reviewer reads sessions and tasks without the ability to publish or run the agent.
- Integration ownership
- Connections are owned by the workspace, not by the person who created them. When that person leaves, nothing silently breaks and no personal token is left holding the keys.
- Audit log
- Sign-ins, permission changes, integration changes, task publications and agent runs are all recorded with actor and timestamp, and are exportable on the Enterprise plan.
Models
How your content reaches a model, and where it stops.
Steelax uses large language models from established providers under commercial agreements that prohibit training on the data we send. Content is transmitted for inference, a response comes back, and nothing is retained by the provider for model improvement.
We do not train our own models on customer content, and we do not share content between workspaces. Two customers with similar products get answers grounded in their own systems and nothing else.
Where a model provider cannot meet those terms, we do not use that provider. The current list is published below and we give notice before it changes.
What is sent for inference
- The excerpts of code and documents relevant to the current question
- The session conversation in the current workspace
- Task text being drafted or reviewed
What is never sent
- Access tokens, secrets or environment values
- Content from any other customer workspace
- Billing records or account credentials
Infrastructure and subprocessors
Who else touches the data.
A complete list. We give 30 days notice before adding a subprocessor that handles customer content, and Enterprise customers can subscribe to those notices directly.
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Application hosting, databases, agent run environments | United States, European Union |
| Anthropic | Model inference for reasoning and code tasks | United States |
| OpenAI | Model inference for embeddings and classification | United States |
| Stripe | Payment processing and invoicing | United States |
| Postmark | Transactional email, such as invitations and alerts | United States |
Workspaces created with European residency keep their index, sessions and run environments in the European Union. Model inference may still be processed in the United States under standard contractual clauses, and we will tell you plainly if that is a problem for your obligations.
Testing and review
We commission an independent penetration test annually and after any significant change to the agent execution environment. Dependencies are scanned continuously, production access requires hardware-backed multi-factor authentication, and every production change goes through peer review.
A SOC 2 Type II examination is underway. Customers evaluating Steelax can request the current report status, our security questionnaire responses and the most recent penetration test summary under a mutual non-disclosure agreement.
Responsible disclosure
If you believe you have found a vulnerability, write to our security address with enough detail to reproduce it. We acknowledge reports within one business day and keep you updated until the issue is closed.
We do not take legal action against researchers who act in good faith, stay within their own test workspace, avoid accessing other customers' data and give us reasonable time to fix what they find.
Report an issue
Questions
What security reviewers usually ask.
Do you keep a copy of our repository?
No. Code is fetched into an ephemeral environment when it is needed and destroyed with that environment. What persists is an encrypted index of structure and meaning, scoped to your workspace, which is deleted within seven days of disconnecting the repository.
Can the agent reach the internet while it runs?
Only your repository host and the package registries your project declares. Everything else is denied at the network layer, so a dependency cannot phone home with your source and neither can anything else inside the container.
Can we stop it from touching certain parts of the codebase?
Yes. Repositories can be connected with directory-level scoping, and you can exclude paths from indexing entirely. Excluded paths are not read, not indexed and not available to the agent.
What happens if your service is compromised?
We notify affected customers without undue delay and in any case within 72 hours of confirming an incident that involves customer data, with what we know, what we have done and what you should do. Tokens are revoked immediately as a first step.
Because tokens are scoped and short-lived, and because code is not stored at rest, the blast radius of a compromise is deliberately small.
Do you support data residency in the European Union?
Yes, for application data, indexes and agent environments. Model inference currently happens in the United States, covered by standard contractual clauses. We say so plainly rather than burying it, because for some teams it is the deciding factor.
Send us your security questionnaire.
We will answer it properly, and we will tell you where we do not yet meet a requirement rather than wording our way around it.
Documentation on requestReport status, questionnaire responses and test summaries under mutual NDA.
Talk to an engineerSecurity reviews are handled by the people who built the system.
Honest gapsWhere something is not ready, we say so before you sign anything.