Your code, your tests, a private copy.

Where your code goes

• A private copy. Your repository is copied into a private GitHub repository in the Trenyx account. Only Trenyx can see it.
• Your tests run on GitHub's machines. Each planted bug runs your own test command on GitHub Actions runners, in the private copy. Nothing runs on your systems.
• Nothing is pushed to your repo. We never open branches or issues on your repository. We open a pull request only to add a test that catches one of your misses, and only with your OK.
• AI models. To write the bug list, your code is read by Anthropic's Claude, with training on our data switched off. It is not used to train models and is not sent to any other AI provider.

Access

• Read only. For a private repo, a read-only deploy key on that one repository. Remove it at any time and the next run doesn't happen.
• No production secrets. Tests run with test values. If your suite needs a database or another service, it starts in a container the way your CI starts it.
• Reports are private. Only the people you name can open them.

What we keep, and for how long

• Kept while you use Trenyx: the private copy, each month's bug list, the CI results and your reports.
• Deleted within 30 days after you stop. Ask and we delete sooner.
• Kept after you stop: an anonymous tally. Which kinds of planted bug your tests caught or missed, and the language. No code, file names, repository or company name. We use it to choose which bugs to plant, and it counts toward our published totals alongside every other run, never shown on its own.

Confidentiality

• Never published without your written permission. Not your code, your reports or your name, not even anonymised.
• Real bugs stay private. If a run turns up a genuine bug in your shipped code, we tell you privately and separately.
• NDA. Happy to sign yours before you share anything.

Security questions: sk@trenyx.io.