Security and data handling
Reviewing code means reading it. This page states exactly what that involves, so you can answer your security team without a call.
What is sent where
| Data | Goes to | Retained |
|---|---|---|
| Diff and surrounding context | Your configured model vendors | Duration of the review only |
| Repository metadata | Dicast | While the repository is enabled |
| Findings and votes | Dicast | Per your plan’s retention window |
| Full repository clone | Nowhere persistent | Ephemeral; destroyed with the review container |
Training
We do not train models on customer code, and our vendor agreements carry zero-retention terms for the API traffic Dicast generates. With your own keys, the terms are the ones you signed with each vendor.
Access controls
- Repository access follows your Git host’s permissions. Dicast cannot show a member a finding in a repository they cannot already read.
- Model vendor keys are encrypted at rest, never logged, and never readable back through the UI or API.
- Employee access to customer data requires a documented support request and is logged. It is not available by default to any role.
Infrastructure
Reviews run in single-use containers with no persistent volume and no inbound network. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Teams that need code to stay inside their perimeter entirely should use the self-hosted runner.
Reporting a vulnerability
Email security@dicast.dev. We acknowledge within one business day. Please do not open a public issue. Our full security posture, subprocessor list and compliance status are on the security page.