Every organization is isolated at the database level, and every project inside it has its own data scope and access boundary.
API keys and bring-your-own-key credentials are encrypted at rest with AES-256-GCM and only decrypted per request.
Google SSO with OAuth 2.0 PKCE and domain restriction per organization, plus passwordless magic links whose one-time tokens expire in 5 minutes.
| Role | Access |
|---|---|
| Super Admin | Full control across every organization on the account. |
| Org Admin | Full control within one organization: users, roles, integrations and settings. |
| Reviewer | Review access to dashboards, skills and alerts for the projects they are assigned. |
| Standard | Day-to-day access to their own activity and the team views their admins allow. |
A 3 KB agent reads the local session data of Claude Code, Cursor and GitHub Copilot without modifying it and captures git commits from the repositories you point it at.
Collected
Never collected
Prompts containing secrets, credentials or PII are flagged before they leave the developer machine.
Every AI action is logged with user, organization, prompt and token spend, so you can answer who sent what to which model.
Run on CloudByte cloud, or keep everything inside your own environment on the Enterprise plan.
CloudByte cloud
Fully managed, with data isolated per organization and per project.
Self-hosted
A single Next.js and Express service on PostgreSQL, containerised and Terraform-deployed. Enterprise plan.
Air-gapped
No outbound access, with in-org model endpoints such as Bedrock or a private gateway. Enterprise plan.
Data retention follows your plan: 7 days on Free, 90 days on Starter, unlimited on Team, and a custom policy on Enterprise. Commit diffs are always deleted after 5 days, while metadata and AI summaries stay for your history.
Found a vulnerability? Email hello@cloudbyte.ai with "Security" in the subject line. Please give us a reasonable chance to fix the issue before sharing it publicly, and do not access data that is not yours.
For questionnaires and procurement reviews, use the contact form and choose the security topic.
Walk through isolation, RBAC, prompt alerts and deployment options with our team, or start free and review the data captured yourself.
