Security & Compliance
Your code stays on your machine
The agent runs where your code is. A request sends the model only what it needs, and you choose the model. Here is exactly what happens to your code and what we keep.
Where the agent runs
- ✓On your machine: the CLI, the editor agents and the Mac app
- ✓Commands it runs and files it edits stay on your machine
- ✓You decide which commands and edits it may make without asking
- ✓There is no MegaBrain cloud machine holding your code
What leaves your machine
- ✓Each request sends the prompt and the code context it needs to the model
- ✓With models on your plan or credits, requests pass through the MegaBrain gateway to the provider
- ✓With your own key or a local model, requests go straight to that provider or model
- ✓We do not train AI models on your code, sell it, or use it for marketing
What we keep
- ✓For each request: the model, token counts, cost and which tool sent it, for billing and your limits
- ✓The first 100 characters of the system prompt and of your last message, for abuse prevention and support
- ✓The exception: if you pick a preview model offered for a partner’s evaluation, the whole request (up to 4 MB) is stored for that evaluation and deleted on request; organizations that turn data collection off cannot use these models
- ✓Your account: name, email, plan and balance
- ✓Payments are handled by Dodo Payments; we never see your card number
Your account and keys
- ✓Sign in with Google or an email link; there is no MegaBrain password
- ✓The agent keeps its sign-in on your machine
- ✓Your own provider keys stay on your machine and are used only with that provider
- ✓Sign the agent out of a machine with `megabrain auth logout`
What you can check
- ✓Which commands and edits the agent may make without asking
- ✓Which models a request may use, and whether it goes through the gateway
- ✓What the gateway records about each request, and for how long
- ✓How to remove your account and its data
Documents & next steps
The agent runs on your machine and calls a model through an API: the model provider sees the requests you send it, under its own terms. Ask for our subprocessor list or a data processing agreement and we'll walk your team through it.