How CodeKnight handles your code

This page describes what the running system does. It is not a contract; commercial terms are separate.

What we read

For each pull request event: the PR diff, and at the reviewed commit a small amount of surrounding code (the enclosing function, exported signatures of imported modules, a nearby test file, and guidance files such as AGENTS.md), capped at 24 KB per review.
We never clone or index your whole repository.

An account admin can switch AI processing off for the whole account in the dashboard. While it is off, no code is sent to any AI provider (no review, escalation, verification, fix, tests, autofix or chat); deterministic checks and dependency advisory lookups continue, and the check run says AI review is switched off.
Only for accounts on a plan with AI review. Only the changed code and the selected context above.
Pull requests from forks and from people who are not collaborators are not sent to an AI model by default for new accounts; an account admin can switch that on. Deterministic checks still run on them.
Credential files (.env, private keys, .npmrc, and similar) are scanned locally and never sent.
Recognised secrets are redacted before sending.
Provider: mistral (model mistral-large-latest) for platform reviews. Use of your own provider and key (bring-your-own-key) is available on the Bring your own key plan. The provider's API data-use terms apply; CodeKnight does not train models on your code.

Review records and findings: kept for your retention period (default 30 days, adjustable 1–365 in the dashboard), then deleted automatically.
Your own model keys: encrypted (AES-256-GCM); the encryption key is held outside the database.
Backups: daily local snapshots (7 kept, encrypted at rest) and encrypted off-site copies (7 daily and 4 weekly) may retain a deleted tenant's review records. Typically that is up to about five weeks after deletion, but retention is count-based, not time-enforced: it can be longer if new snapshots or uploads stop succeeding, because old copies are pruned only after a successful new one.
Dependency advisories: server-side and GitHub-mode reviews send added or changed npm package names and versions (never source code) to api.osv.dev for advisory lookup. This does not run with --offline or in local CLI mode.
CLI and editor extension: when you use server-side AI review while signed in, redacted diffs are uploaded to CodeKnight's POST /api/v1/review endpoint. Nothing is uploaded with --offline, with a local key, or without AI.
Usage and cost records, and an audit log of administrative events: kept for billing and security. They contain no source code.
When you uninstall the GitHub App, all review data, repositories and keys are deleted after 7 days, and any CodeKnight subscription is cancelled. Reinstalling within that time cancels deletion. After uninstalling you can also delete immediately from the dashboard.

A review comment with inline findings and a "CodeKnight" check run. CodeKnight never approves, requests changes or merges, and never pushes to your branches.
Autofix (off by default; an organisation admin turns it on) needs the Contents: read & write permission. It writes only paladin/fix/* branches and draft pull requests, and never merges or approves.