Architecture first. Certifications later.
We're early. There's no SOC 2 report to wave around yet. What we do have is an architecture that doesn't require trusting us, and six facts that are verifiable today.
Each pull request runs in its own microVM
Code analysis runs in Firecracker microVMs on Fly Machines. That's the same hardware-virtualization technology that backs AWS Lambda. Each pull request gets its own VM with its own kernel and memory, and the VM is destroyed when the analysis finishes. No shared state between reviews.
AI inference runs through Fireworks AI
Fireworks's privacy policy commits to no training on customer prompts (opt-in only) and zero data retention by default. Prompts live in volatile memory for the duration of the request and nothing else. Fireworks is SOC 2 Type II and HIPAA compliant. They're the only inference provider we use today.
Source stays scoped to the review
We store the diff inside your review document so the IDE can render it back to you. That document is scoped to your organisation. No analytics replicas, no archives, no replication to anywhere else.
EU-hosted control plane
Application data lives in the EU. Inference goes through Fireworks (US-domiciled) under a data processing agreement. We disclose every sub-processor we touch.
Hash-chained audit log
Every comment, every resolution, every reviewer assignment chains into a per-organisation SHA-256 log. Append-only, tamper-evident, and exportable any time.
GDPR-aware by default
Per-organisation data isolation. Standard DPA available on request. Right to erasure is honoured: we can delete a review's data, or an entire organisation, on request.
Sub-processors
We publish a current list of every third party that processes customer data on our behalf, including their role, jurisdiction, and the legal mechanism that governs transfers outside the EEA. See /sub-processors. Customers are notified at least 30 days before we add or replace a sub-processor.
Vulnerability disclosure
If you believe you have found a security issue, mail security@acuvis.dev. Coordinates are also published at /.well-known/security.txt per RFC 9116. We acknowledge new reports within two business days and aim to triage with a target severity within five. We will not pursue legal action against good-faith research conducted within the scope listed in security.txt.
Incident response
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we notify the Polish supervisory authority (UODO) within 72 hours and notify affected customers without undue delay, in line with Art. 33 and 34 GDPR. For confirmed service-level incidents we post updates to the status page and publish a post-mortem within ten business days of resolution.
Vendor assessments and DPA
Need a signed DPA, SCCs, or our vendor-assessment questionnaire? Visit /dpa or mail security@acuvis.dev and we will get back to you.