Security
What land keeps, where it runs, who can reach your code, and how to delete it. This page describes land as it runs today.
| Does land keep my code? | Yes. A copy of each repository you add and of the changes your agents send, until you ask us to delete it. |
| Does land read my GitHub? | No. Signing in reads your public GitHub profile and nothing else. Your agent pushes results to GitHub with its own access. |
| Where does it run? | Google Cloud, in Mumbai (asia-south1). |
| Is it encrypted? | In transit over HTTPS. At rest by Google Cloud's default disk encryption. |
| Can my tests reach the internet? | No. Tests run with no network. |
| Can other customers see my code? | No. Every account sees only its own repositories. |
| Certifications? | None yet. land is not SOC 2 audited. |
What land keeps
| What | What's in it | How long |
|---|---|---|
| Your repository | The committed files from land add (no history, never .env) and the commits land merge sends | Until you ask us to delete it |
| Test memory | File paths, function names and line ranges, which functions each test reads, content hashes, and each test's result and output | Until you ask us to delete it |
| Landing log | When each change was checked, whether it landed, how many tests ran, and how long it took | Until you ask us to delete it |
| Your account | Your GitHub user ID and login. No email address, and no GitHub token is kept | While you have an account |
| Keys and tokens | Stored only as hashes, so a copy of our database can't be used to sign in | Until revoked |
| Payments | Handled by Stripe. land never sees your card number | Stripe's terms |
land keeps a copy of your code because it merges onto it and remembers which tests each function affects. That memory is how it skips tests. The test memory itself holds names, line numbers and hashes rather than your files, though a test's output can quote your code when it fails.
How tests run
- Each check runs in its own container with no network, and with limits on CPU, memory and processes.
- Your tests and the code they call run as an unprivileged user. They can't change land's record of what passed.
- Dependencies are installed once when you add the repository, with network on for the install only. Every test run after that is offline.
- Containers from different accounts run on the same machines and share the machine's kernel. They are not separate virtual machines.
Who can reach your code
| Who | What they can do |
|---|---|
| You | Everything in your account, after signing in with GitHub |
| Your agents | With the key from land login, send changes to land. main moves only when land's check passes |
A LAND_TOKEN | Only the repositories named when it was made. It can run land merge, but can't add repositories or make new tokens |
| Other land accounts | Nothing |
| Ataraxy Labs | The engineers who run land can reach the servers, and do so only to operate and fix the service |
GitHub
Signing in asks GitHub for no permissions, so land sees only your public profile. land never clones, reads or pushes your GitHub repositories. It hands your agent a commit, and your agent pushes it with the access it already has. Turn on signed commits and your agent makes the commit itself with --result tree.
Deleting your data
There's no delete button yet. Email rohan@ataraxy-labs.com from the address on your GitHub profile, or name your GitHub login, and we'll delete the repository copies, test memory and landing log for your account and write back when it's done.
Reporting a problem
Found a security issue? Email rohan@ataraxy-labs.com with what you found and how to reproduce it. Please give us a chance to fix it before you share it publicly.