# Security and trust

How code and accounts are stored, who can reach them, and how to report a problem.

## Where things live

- **Code** is stored in Git on Cloudflare: Cloudflare Artifacts, or our own Git storage on Cloudflare R2. Each project's code is separate from every other project's.
- **Accounts** are in a Cloudflare D1 database: your GitHub login, name, picture and email, your teams, and your sessions. GitHub access tokens are encrypted before they are stored, and are only read on the server.
- **History, merge records and audit events** are kept per project and per team.

## Who can reach what

- Projects belong to teams. Owners and admins run a team; members see the projects their team gives them.
- Keys are scoped: an admin key for a project, a task key that writes only its own task, and agent group keys that hand each agent its own task. Checks and sandboxes never hold a credential.
- A signed-in session works only from Switchyard's own pages. Changes made with a session must come from those pages.

## Sign-in

- Sign-in is with GitHub. During the private beta only approved accounts can sign up.
- Sessions are signed with a key the database does not hold, so a copy of the database alone signs nobody in. Session cookies are Secure, HttpOnly and SameSite=Lax.
- Your account page lists where you are signed in. You can sign out one place, or everywhere, including `yard` in terminals.
- You can delete your account from the account page. You leave every team; a team only you are in, with no projects, is deleted with you. If you are the only owner of a team others are in, or of one that owns projects, hand it over first.

## AI fixes

- Off until an owner or admin of the organization turns them on in its settings. They come with the Team plan; the free plan has none. Turning them on or off is in the audit log.
- When the file rules cannot merge a code conflict, Anthropic receives, for that one file: its path, the file as the task has it (when it is under 60 KB), each conflicting part with its earlier text, both sides and up to six lines around it, and what each side was doing (its task, plan and commit message). Nothing else from the repository, and never a key or a secret.
- It goes to Anthropic's API (Claude Opus 5.5) under Switchyard's own key, or under the organization's own Anthropic key if an owner set one.
- Claude's answer is a proposal and changes nothing until the task's agent or a person accepts it. The history records which model answered and what the answer cost.
- Each organization on Team has 100 a month. Past that, the conflict goes to a person, and the page says why and when the count starts again.

## Evidence

- Every sensitive action is in your team's audit log for 400 days, and can be exported.
- Every merge has a merge record of what merged, why it was allowed, and which checks passed. Commits are signed on each agent's behalf.

## Who processes your data

| Company | For |
|---|---|
| Cloudflare | Hosting, code storage, databases and email |
| GitHub | Sign-in, and the repositories you choose to connect |
| Anthropic | AI fixes, only for organizations that turn them on or set their own Anthropic key |

## Reporting a problem

If you find a security problem, please tell us privately before telling anyone else, and give us a reasonable time to fix it. Write to security@switchyard.so.