← Back to home
Security & Privacy

Built for engineering orgs that can't afford a breach.

AgentLens was designed from day one to answer one question with the minimum possible data. No source code. No diffs. No commit messages. Just the metadata that lets us measure ROI.

No source code storedNo diffs storedMetadata only

What we access

GitHub App permissions requested

  • metadataRepo names, commit timestamps, author email hashes

    Never message contents. Email addresses are one-way hashed before storage.

  • contents: readRequired for Copilot API only

    Used exclusively to query the GitHub Copilot Metrics API endpoint. We do not read file contents.

  • Copilot Metrics APISeat counts, acceptance rates

    Aggregate-only org-level telemetry provided by GitHub. No individual-level data is ingested.

What we never store

  • ✕Commit message contents
  • ✕Source code or diffs
  • ✕Individual developer productivity scores surfaced publicly
  • ✕Any customer data after 30 days post-cancellation

Data architecture

▸

Multi-tenant RLS

Supabase Row Level Security

GitHub org data never crosses customer boundaries. Every query is scoped to the authenticated org at the database level — not the application layer.

▸

Separate benchmark schema

Zero customer identifiers

Anonymization pipeline aggregates before writing to the benchmark schema. No org name, user ID, or repo slug survives the pipeline.

▸

Hard delete

30 days post-cancellation

All customer data is permanently deleted 30 days after cancellation. Anonymized benchmark aggregates are retained — they contain no PII.

GDPR

AgentLens processes personal data (email address hashes, GitHub user IDs) as a data processor on behalf of your organisation as data controller. You retain full ownership of your data.

Your team members have the right to access, erasure, and data portability under GDPR Articles 15, 17, and 20. To exercise these rights, contact privacy@agent-lens.app.

We are registered with the UK Information Commissioner's Office (ICO). A Data Processing Agreement (DPA) is available on request for enterprise customers.

GitHub Actions & bot commits

Bot commits excluded

GitHub Actions bot commits are identified and excluded from AI detection entirely. They are labeled Automated commits in your dashboard and tracked separately so they never inflate or deflate your team's AI adoption metrics.

Questions? security@agent-lens.app