Trust, security, and data handling

Static files send nothing. MCP retrieval tools are read-only lookups. Feedback tools only run when your agent surfaces them and you confirm. Code passed to a validation tool is sent to an external LLM provider (OpenAI, US); when a standard run scores production_ready we keep the submitted code for 24 hours so architect.certify can verify it, after that it can no longer be used and an automatic clean-up deletes it; private sessions keep no code. Retention follows your choice: a standard run keeps a stored run with us and is persisted at OpenAI; a private session keeps no stored run and is not persisted at OpenAI. Our operational security and cost logs, and OpenAI's abuse-monitoring retention, apply to both. Triage is never persisted there, and only standard runs can be certified. Repository scans (the from-repo flow) always run as standard runs; there is no private_session option on that surface. Full details in our privacy policy.

When you pass private_session=true on architect.validate, design.validate, or spec.validate, the server skips the stored run: no run_id, result_json, or badge. The payload is processed transiently in memory and AI Design Blueprint persists no copy of your code, artefact, or spec. Operational security and cost logs, which record who ran what and when, the calling client, the client software and version it declares, which install package it came from (a fixed identifier in the plugin manifest, never anything about you), and, on MCP calls, a keyed one-way digest of the network address (a pseudonym, not the address itself), the lookup text or target (a search query, a principle, cluster, or example name, or, for a validator run, the repository and any error text), and whether the call succeeded and how long it took, but never the raw user-agent string itself (only the calling client and declared software/version already listed), and, for validation calls, a request summary (your task or focus area, the repository identifier, up to three file paths and the code language), but never the payload itself, are retained per our Privacy Policy for abuse, availability, and incident investigation. A plugin install's connection handshake is recorded once as its own row, even if no tool is called afterwards. Content is blanked after 90 days, identifying fields after 12 months, and the anonymous row itself after 24 months, under our legitimate interest in operating and securing the service. Account erasure unlinks those log rows from your account rather than deleting them. OpenAI's own retention is governed by their API terms.

{
  "tool": "architect.validate",
  "arguments": {
    "implementation_context": "...your code...",
    "private_session": true
  }
}

Available with a Pro, Pro Plus, Teams, Enterprise, beta, or trial plan; on architect.validate, also with a validate topup balance. The bypass logic is enforced in code at the MCP server layer, not a promise in Terms of Service, but an architectural invariant.