Security and privacy
Six rules bind every part of ALIGN. They are shown before anyone installs, and each has a test in the code that enforces it.
The six rules
- Scope by repository. Capture happens only in repositories the organisation connected and the
developer opted into. Personal repositories never report.
align statusshows the scope;align offstops capture for this repository immediately, locally and on the server. - Redact on the laptop. Everything that could leave the machine passes the redaction engine first:
transcripts, commit messages, and every argument of
align decide,align askand the MCP tools. File contents never leave, including anything the agent read or wrote through tools: transcripts carry the user's and the agent's words only, fenced code blocks become‹code: N lines›, and every tool call becomes‹tool: <name>, <bytes> bytes›plus the repository-relative paths it touched. Tool outputs, diffs from your laptop and the shell commands tools run are never captured. Text you paste without a code fence is sent after secret redaction. The server redacts everything again, including GitHub, Slack and Linear text, before it stores it or sends it to a model. - You see everything about you, and you can delete it.
align sessionslists what was kept;align sessions rm <id>deletes a session and everything derived only from it: its lines and events, the quotes taken from it, and the wording of proposals nobody confirmed. Proposals from your sessions are visible only to you until you confirm them, share them, or they appear in a pull request you opened. Teammates never read your raw transcripts; they see only the short quotes that support a confirmed decision. - The organisation owns the ledger; sources keep their permissions. A person sees an entry only if they can access its repository; a receipt from a private Slack channel is visible only to that channel's members.
- No scoring of people. No per-developer productivity metrics in the product, analytics, logs or exports. Seat counts for billing are aggregates. Every change goes through automated review and CI before it ships.
- Retention by default. Raw events and transcript lines are kept 90 days, then deleted unless a receipt cites them. Deleting an organisation starts a 7-day grace period you can cancel; deletion then completes within 24 hours, and backups age out within 7 more days.
What we collect
| Data | Source | Purpose | Retention |
|---|---|---|---|
| Account: name, email, GitHub user id and login, avatar URL | sign-in (Identity Platform: GitHub, or an email link) | sign-in, mapping GitHub and Slack identities | while the account exists |
| Sign-in record held by Identity Platform: its user id, email, linked GitHub identity | Identity Platform, at sign-in | signing in | while the account exists |
| Browser sessions: a hashed session token and its sign-in and last-use times | console sign-in | keeping a person signed in; "sign out everywhere" | valid until sign-out or revocation, 14 days without use, or 90 days after sign-in; the record is deleted 30 days later |
| Organisation: name, settings, members, roles | console | tenancy | while the organisation exists |
| Repository metadata: remote URL, root commit hash, default branch, visibility | CLI, GitHub App | identify repositories | while connected |
| Session events: timestamps, harness name and version, branch, head commit, repository-relative paths the agent touched, and a salted hash of the machine's name (the salt stays on the laptop; it tells one person's machines apart) | CLI hooks and transcripts | compile decisions, scope them to code | 90 days unless cited |
| Conversation text (user and agent messages, secrets redacted, fenced code blocks and tool contents replaced by placeholders; text pasted without a code fence is included) | CLI hooks, opt-in backfill | compile decisions; quotes as receipts | 90 days unless cited; deleted with its session |
Text a person or their agent records (align decide, align ask, MCP record_decision, ask_owner) | CLI, local MCP server | the ledger | until the organisation deletes it |
| Commit messages and trailers, changed paths | CLI git hooks, GitHub App | link decisions to code | while the repository is connected |
| Check results: paths and line numbers | worker, CLI | verification | 180 days |
| Slack messages that mention ALIGN or answer its questions | Slack app | answers, receipts | while cited, else 90 days |
| Linear issue title, description, branch name | Linear app | briefs and contracts | while connected |
| Pull-request diffs: the hunks under a decision's scope (and test-file hunks for contracts) | GitHub App | judging conflicts and contract coverage | processed in memory after secret redaction, sent for model processing on Google Cloud's Agent Platform, not stored |
| Ledger exports a person asks for | console, CLI | export | the file behind the download link is deleted after 1 day (storage removes it within 2 days at most) |
| Pilot and terms acceptances: document, version, time | console, CLI | records of consent | while the account exists |
| Billing: plan, seat counts, provider customer and subscription ids | us (invoices), or the billing provider once online checkout opens | billing | per tax law |
| Operational logs, error reports and traces: ids, counts, durations, status codes, error codes and stack traces (no content) | web, worker, jobs; browser errors scrubbed and sampled | reliability | 30 days (Cloud Logging, Error Reporting, Cloud Trace) |
What we never collect
File contents (including what an agent read or wrote through tools), the shell commands tools run and
their output, diffs from your laptop, fenced code blocks, environment variables or .env files, secrets
matching the redaction rules, keystrokes, screen contents, hostnames (only the salted hash
above), OS usernames, IP addresses in event
payloads, paths outside the repository, data from repositories that are not connected and opted in, Slack
channel history, per-person productivity metrics.
Data classes
Everything we hold is in one of these classes, and each class may go only where this table says.
| Class | Examples | May go to |
|---|---|---|
| Public | docs, landing | anywhere |
| Internal | repository names, entry statements and keys | organisation members with repository access; GitHub comments in private repositories; Linear briefs only when the organisation turns statements on |
| Confidential | transcript lines, quotes, PR hunks sent to the judge, Slack and Linear text | Postgres with RLS (Cloud SQL, us-central1); Agent Platform (Google) for processing (after redaction); the requesting member's own agent session and that agent's model provider (get_decision, get_context, get_contract: a Linear contract's criteria, labelled as Linear's text); never logs, error reports, analytics, GitHub comments, digests or share pages |
| Secret (developer) | credentials appearing in sessions | never leave the laptop |
| Secret (connector) | Slack and Linear tokens, the GitHub App private key, third-party API keys | connector tokens encrypted with Cloud KMS (envelope encryption; the KMS key never leaves KMS); keys in Secret Manager, read by the runtime identities that need them; never logged |
How it is protected
- Hosting. The service runs on Google Cloud in
us-central1(Iowa, United States): Cloud Run behind a load balancer with Cloud Armor, and Cloud SQL for PostgreSQL with row-level security on every table. - Access. Every read is checked against repository access in the database itself. Proposals from your sessions are visible only to you until you confirm them, share them, or they appear in a pull request you opened; raw transcripts only to the person whose session it was.
- Sign-in. GitHub or an email link, never a password. Browser sessions and CLI tokens are random, stored hashed, expire and can be revoked, including "sign out everywhere".
- Keys. Connector tokens are encrypted with Cloud KMS; keys live in Secret Manager. Database logins are IAM identities with no passwords.
- Logs. Logs and error reports carry ids, counts, durations and codes only, never content.
- Releases. Production changes only through a release a person promotes; the build machines cannot change production. They, and the AI coding tools that run on them, can read production's operational data (ids, counts, durations, status and error codes), never content.
Subprocessors
| Subprocessor | Role | Region |
|---|---|---|
| Google Cloud | hosting (Cloud Run), database and its backups (Cloud SQL), sign-in (Identity Platform), logs, error reports, traces and uptime checks (Cloud Logging, Error Reporting, Cloud Trace, Cloud Monitoring), key management (Cloud KMS, Secret Manager), export files (Cloud Storage) | United States (us-central1, Iowa) for data at rest |
| Google Cloud Agent Platform: Google's Gemini models | model processing of redacted text and redacted PR hunks; not used for training ("Google won't use your data to train or fine-tune any AI/ML models without your prior permission or instruction"); Google's project-level data caching, which by default keeps inputs, outputs and derived data in memory and on disk for up to 24 hours and is also what implicit context caching uses, is turned off in both our projects, staging and production (disableCache, set in our infrastructure code), so Google keeps no cached copy; request-response logging is off (Google's default) and we create no explicit caches; the one retention left is Google's abuse monitoring: only if its automated classifiers flag a request, Google may log the prompt for up to 90 days in the region or multi-region of the request, solely to check for policy violations, not encrypted with customer-managed keys and never used for training (this applies to customers on Google Cloud's online terms; a Google Cloud Master Agreement exempts it). Sources: Google's "Generative AI and zero data retention", "Context caching overview" and "Abuse monitoring" pages, read 22 Oct 2026 | the global endpoint: a request, and any abuse-monitoring log of it, may be processed in any Google region; we store nothing there |
| Resend | email delivery, including sign-in links | US |
| GitHub, Slack, Linear | the customer's own tools, via the apps they install | per vendor |
| Paddle | merchant of record for orders placed through online checkout, once it opens; until then we invoice paid plans ourselves and no billing provider receives your data | per vendor |
| Anthropic | only two kinds of data, never customer content: (a) evaluation cases for comparing model quality, made from synthetic fixtures and our own organisation's build sessions, sent through Anthropic's API; (b) operational data, because the agents that build and operate the service are Claude Code agents running on Anthropic's service, and they can read our production logs and error reports: ids, counts, durations, status codes, error codes and stack traces, which carry no content. The product's own model calls (compiling decisions, judging pull requests) use only Google's Gemini models on Agent Platform, never Claude; if that ever changes, this list changes first | per vendor |
| The member's own coding agent or connected app (such as Claude.ai or ChatGPT through the remote MCP endpoint) and its model provider | receives entries and quotes the member asks for through the agent tools, only after the member connects it and approves access for one organisation | the member's choice |
The list, and how we announce changes to it, is on the subprocessors page.
Deleting and exporting
Developers delete their own sessions at any time (align sessions rm, console): lines, events, quotes
from them and the wording of unconfirmed proposals go immediately. Owners delete the organisation from
settings: a 7-day grace period they can cancel, then deletion completes within 24 hours, and backups and
point-in-time recovery logs age out within 7 more days. Export in open formats at any time. Requests to
privacy@bharatreachdsp.com answered within 7 days. Incidents affecting customer data are notified within 72 hours.
Reporting a problem
Report a vulnerability or a suspected incident to security@bharatreachdsp.com. Please give us a reasonable time to fix it before disclosing it, and do not access other people's data while testing.