Security at Proxy

• Least-privilege access. Read-only where possible, scoped to the repos you pick, revocable in one click.
• Proxy never merges and never sends. It opens pull requests and drafts messages; a human always ships them.
• Your code is never used to train models.
• Every company is isolated — separate storage, separate compute, enforced by the database itself.
• We keep as little as possible, and delete everything on request.

GitHub. A GitHub App (not a personal token), installed on your org and scoped to the repositories you select. It requests exactly: repository contents, pull requests, issues, metadata, and read-only Actions and Checks.

It does not request — and therefore cannot touch — organization administration, repository secrets, environments, or workflow definitions. Proxy cannot change your CI, read your secrets, or alter org settings.

Slack. Only the ability to post and to read the channels it is invited to, plus email lookup so it can reach the right person. Not full history, not admin.

Calendar. Read-only, events-only. No mail, no files, no write access.

Any grant can be revoked by an admin at any time, and access stops immediately.

Work happens in an isolated, per-meeting sandbox that is created for that meeting and destroyed when the work is done. The sandbox is deliberately powerless: it holds no credential that can push code or send a message. Those live only in our control plane.

The practical consequence is the guarantee that matters most: Proxy can prepare a change and open a pull request for you to review, but it cannot merge to your default branch and it cannot send a message as you. That is enforced by which credentials exist where — not by asking the model to behave.

Every record carries its company's identity, and the database enforces that boundary itself with row-level security — so even a bug in application code cannot return another company's row. Compute is per-meeting and never shared. Storage is separated per company.

We test this continuously, including under concurrency: a recent verification ran a hundred companies signing up simultaneously and confirmed complete isolation.

• In transit: TLS everywhere.
• At rest: managed encryption for all storage, plus a second layer — per-company credentials are individually encrypted with AES-256-GCM.
• Secrets live in a managed secret store, never in source control, never in logs.

Proxy runs on Anthropic's Claude models through Google Cloud Vertex AI under enterprise terms. Your code and conversations are not used to train models, and are not retained by the model provider.

Proxy is built to be grounded: it cites the real file and line behind an answer, or it says it does not know. Meeting content is treated as untrusted input — instructions embedded in a transcript or a document cannot make Proxy act on them.

We keep what the product needs and little else: your notes and work product, the code understanding Proxy builds, and operational logs. Meeting audio is consumed live and not retained by us.

Deletion works. On request we purge your company's data — records, stored artifacts, and credentials — and revoke every token. You can also disconnect any integration yourself at any time.

We use a small set of vendors, each for one job: Google Cloud (hosting and databases, United States), Anthropic via Google Vertex AI (the model), E2B (isolated sandboxes), and for meetings Recall (joining and carrying audio), AssemblyAI through Recall (transcription) and OpenAI (the live voice session, which receives the meeting's audio and transcript and produces Proxy's spoken replies). A current list with details is available on request and is named in our DPA.

Proxy is an early-stage company and we would rather tell you exactly where we stand than imply more.

• We are not SOC 2 certified yet. The controls described here are real and in place; the formal audit is not something we have completed.
• We have not commissioned a third-party penetration test yet. We run automated security scanning on our code, dependencies, and cloud configuration.
• Meeting features are rolling out; where a capability above applies to a feature you have not been given yet, it applies from the moment you are.

If your security review needs something specific — a DPA, a completed questionnaire, or a conversation with an engineer — just ask. We will answer directly.

Email security@useproxy.co. We will acknowledge quickly, keep you updated, and we will not take legal action against good-faith research.