Security & Privacy
Git AutoReview is built with a privacy-first architecture. Your code never touches our servers. You control your data.
No Code Storage
Your code is never stored on our servers. It's sent directly to your chosen AI provider for analysis and discarded after review.
BYOK (Bring Your Own Key)
Use your own API keys for Claude, Gemini, or GPT. You pay the AI provider directly. We never see or store your API keys on our servers.
Encrypted Storage
API keys and credentials are stored in VS Code's SecretStorage, which uses your OS keychain (macOS Keychain, Windows Credential Manager, or Linux Secret Service).
No Telemetry
We don't collect telemetry, analytics, or usage data without explicit consent. Your coding activity stays private.
How Your Data Flows
You trigger a review
Click 'Review' on a PR in VS Code
Code is fetched
PR diff is fetched from Bitbucket to your local machine
Sent to AI provider
Code is sent directly to Claude/Gemini/GPT using YOUR API key
AI analyzes
AI provider processes the code and returns suggestions
You review
Suggestions displayed locally. You approve/reject each one
Published to Bitbucket
Only approved comments are posted to your PR
Privacy by Architecture
Unlike SaaS code review tools that process your code on their servers, Git AutoReview uses a privacy-first architecture:
- Code never touches Git AutoReview servers
- API keys stored in OS-level encrypted storage
- Direct connection to AI providers (no proxy)
- Works behind corporate firewalls (Server/DC)
- No data retention — code discarded after review
- Open architecture — you control the data flow
AI Provider Data Policies
When you use Git AutoReview, your code is sent to your chosen AI provider. Here are their data policies:
Frequently Asked Questions
Does Git AutoReview store my code?
No. Your code is sent directly from your machine to your chosen AI provider (Anthropic, Google, or OpenAI). We don't have servers that process or store your code. After the AI returns suggestions, the code is discarded.
Where are my API keys stored?
API keys are stored in VS Code's SecretStorage, which uses your operating system's secure credential storage: macOS Keychain, Windows Credential Manager, or Linux Secret Service. They are encrypted at rest and never exposed in logs.
Can Git AutoReview access my code without my knowledge?
No. Git AutoReview only accesses code when you explicitly trigger a review. It doesn't run in the background, doesn't auto-sync, and doesn't send any data without your action.
Is Git AutoReview compliant with enterprise security policies?
Git AutoReview is designed for enterprise use. With BYOK, no code storage, and support for Bitbucket Server/Data Center behind firewalls, it meets most enterprise security requirements. Contact us for specific compliance questions.
What data does Git AutoReview collect?
By default, none. We don't collect telemetry, usage analytics, or any data about your coding activity. If you opt-in to crash reporting, only anonymized error data is sent.
Security Questions?
Contact us for enterprise security assessments or compliance documentation.
security@gitautoreview.com