Privacy Policy

• Account information — your name and email address, and a scrypt hash of your password (never the plaintext).
• Onboarding metadata — the requests you create: fork name, chosen profile, optional Slack channel, your support-access preference, and timestamps. We also record boolean flags indicating that a credential was supplied, but not the credential itself.
• Credentials you supply — your Claude Code token and any GitHub or Slack tokens. These are stored encrypted for your agent to use (see below).
• Operational logs — standard request and error logs needed to run and debug the service. Credentials are excluded from logs.

Credentials are written directly to your agent's dedicated AWS Secrets Manager secret, encrypted at rest with a per-tenant key. They are not stored in the provision request, not returned by any API, and not logged. They are used solely to operate the agent you onboarded. See Security for the technical detail.

We use the data we collect to:

• create and authenticate your account;
• onboard, operate, and support the agents you request;
• isolate your tenant's data from other tenants;
• maintain, secure, and improve the service.

We do not sell your data, and we do not use your credentials for anything other than operating your agent.

Account records and onboarding metadata are stored in Amazon S3, and credentials in AWS Secrets Manager, within an Isomorph-controlled AWS account in the United States. Access is restricted to the platform and control-plane services.

Operating your agent involves the providers whose credentials you supply or whose services the platform relies on — including Anthropic (Claude), GitHub, Slack, and Amazon Web Services. Your use of those services through your agent is also governed by their respective terms and privacy policies.

We retain account and onboarding data for as long as your account is active. When you close your account or we deprovision your agents, we delete the associated credentials and may delete associated records. Operational logs are retained for a limited period for debugging and security.

• You can opt out of one-way SSH support access when you onboard an agent.
• You can request deletion of your account and associated data by contacting us.
• You control the scope of every credential you supply.

We may update this policy as the service moves out of pre-alpha. We'll update the effective date above when we do.

Questions about your data or this policy? Email privacy@isomorphlabs.io.