VeflowVeflow
Security

Agents you can trust with your code.

Veflow runs untrusted code for a living, so isolation, least-privilege, and tenant separation aren't extras. They're the foundation. Here's how we keep your code, data, and secrets safe.

Data flow

Your code doesn't have to leave your machine.

An open-source license isn't what keeps your code private — where it runs is. A hosted open-source editor still uploads your code to a server. With Veflow you choose, and our local mode keeps your code on your device.

Local · bring your own agent

Agents run on your own machine, on your own Claude, Codex, or Copilot subscription. Your source code and terminal activity stay on your device — our servers never receive them.

  • Code, diffs, and terminal output never touch our servers.
  • We sync only session metadata: repository and branch names, timestamps, and status.
  • Runs entirely in the desktop app — no cloud compute in the loop.

Managed · cloud runs

When you choose a managed run, we clone your repository into a single-tenant, ephemeral container that is destroyed the moment the run ends. Nothing is kept on our infrastructure afterwards except the run record you can see.

  • Each run is isolated; the container filesystem is wiped when it finishes.
  • The agent conversation (including diffs) is saved to your workspace so you can review it — and removed when you delete it.
  • Prompts go to your model provider (Anthropic or OpenAI) over TLS and, per their API terms, are not used to train their models.

Precise, not vague.

In local mode we genuinely can't see your code. In cloud mode we process it only to do the work you asked for, and we tell you exactly what's stored. The full detail is in our Privacy Policy.

How we protect your code and data.

  • Isolated per-tenant runtimes

    Every workspace and preview runs in its own sandboxed cloud container. One tenant's code can't reach another's files, processes, memory, or network.

  • Least-privilege GitHub access

    Tokens are scoped to a single repo with only the permissions a task needs. Master keys stay on our edge. They never touch your code or dependencies.

  • Secrets stripped from untrusted code

    Dependencies and dev scripts run with our infrastructure secrets removed from their environment. A malicious package has nothing to steal.

  • Your secrets stay sealed

    The env vars you add are sealed with authenticated encryption before they're stored, and the key is held off the database, so backups and exports only ever hold scrambled text. They're decrypted only server-side, at boot, to write the .env inside your isolated workspace, and never shown again.

  • Row-level security by default

    Your data sits behind Postgres row-level security, scoped per workspace and enforced at the database, not just the app layer.

  • Encrypted in transit

    Every connection (app, preview tunnel, and API) is served over TLS. Preview URLs run behind per-task tunnels on our edge, not open ports; the in-browser IDE and dev tunnels add a signed-in membership check on top.

  • Attributable audit trail

    Every decision, edit, comment, and status change lands in a durable, attributable activity feed. Weeks later you can still see who did what, and why.

  • Your code isn't training data

    Inference runs on the Anthropic API under terms that exclude training on your data. Agent runners are ephemeral: your repo is cloned for the run and destroyed with the container. What persists is the task record you already see: plans, diffs, comments.

Built for the GDPR.

You can access, export, correct, or delete your data at any time. Every processing purpose, sub-processor, and international-transfer safeguard is documented in our Privacy Policy.

Read the Privacy Policy

Questions about security or compliance?

We're happy to walk through our architecture, data handling, and roadmap. SAML, a security review, and self-host options are available on Enterprise.

Talk to us