What CodeObsess can see
- Your tickets: the ticket’s title, text, comments, links and people, for the tickets you ask CodeObsess to work on. Attachment files are not fetched.
- Your repositories: the repositories you chose, copied for a run. CodeObsess reads them and changes only those set to Write.
- Your account: your name, your account email and the GitHub, Linear or Atlassian accounts you link or sign in with.
- Your AI provider: a run sends the ticket and the code it works on to the AI that runs it (your Claude account, or your company key’s provider), under that provider’s terms.
What CodeObsess keeps from itself
- Your Claude login. You sign in on claude.ai; we never see your password. Your Claude login is kept in a private storage space on CodeObsess’s servers that only your tickets use. CodeObsess’s code never reads, copies or refreshes it.
- Your company AI keys, after saving. A key is stored sealed and never shown again. A run never receives the key itself.
- Other companies’ data. The database itself keeps each company’s data apart.
How a run is kept safe
- Each run happens in its own locked-down space, with only the repositories it needs. The run’s container is removed when the run ends; its working copy is deleted after 14 days.
- The run never holds your code host’s access token. CodeObsess checks the run’s commits, then pushes them itself.
- CodeObsess never merges, never force-pushes, and never makes releases or tags.
- Known token formats are hidden in what CodeObsess writes: in your tickets, on its pages and in pull requests. A push that contains one is refused.
- On GitHub Issues, text from someone outside your company is treated as reference only, never as instructions.