What Happens to Your Source Code During an Agiloop Assessment?

When you connect an existing software project to Agiloop, we need temporary access to your source code to perform code-based assessments. We understand that providing access to a source code repository raises important questions about how that code is accessed, handled, processed, stored, and protected.

This article explains what happens from the time you connect your repository through completion of an assessment.

Connecting Your Repository

When you onboard an existing project, Agiloop provides two ways to connect to your source code repository.

GitHub or GitLab OAuth

When using GitHub or GitLab, you can authenticate with your repository provider through its OAuth authorization process and select the repository you want to onboard into Agiloop.

Agiloop requires read access to the repository. This allows Agiloop to retrieve the source code required for onboarding and assessment but does not give Agiloop permission to modify your repository.

Manual Connection

You may alternatively provide repository connection credentials manually.

As with the OAuth connection, Agiloop requires only the access necessary to read the repository for onboarding and assessment.

How Repository Credentials Are Handled

The repository access token or credentials are cached in encrypted form and associated with the specific Agiloop project.

The token may expire based on the policies of the repository provider or credentials being used. You can also remove the stored repository connection at any time from the project's settings.

Removing the connection prevents Agiloop from using those credentials for future repository access.

What Happens When an Assessment Runs

Code-based assessments are performed in an isolated, temporary container created for the analysis.

For each assessment, Agiloop:

1. Starts an isolated analysis container.

2. Uses the project's repository credentials to clone the repository into temporary storage within that container.

3. Performs the requested analysis against the temporary working copy.

4. Uses AI models as part of the analysis process to generate the requested assessment.

5. Stores the resulting assessment with the Agiloop project.

6. Deletes the cloned repository from the temporary environment.

7. Discards the analysis container.

The temporary source code working copy therefore exists only for the duration of the analysis.

How AI Models Are Used During an Assessment

Agiloop's code-based assessments use frontier AI models provided by Anthropic to analyze your project.

The assessment is performed using Agiloop-managed Anthropic API credentials. You do not need to provide your own Anthropic account or API key.

During an assessment, the isolated analysis environment may provide source code and other repository context to Anthropic's models as necessary to perform the requested analysis. This processing is part of the assessment workflow and is used to generate findings, scores, explanations, and recommendations for your project.

Agiloop does not use your source code to train Agiloop models or create training datasets from customer repositories.

Is My Source Code Used to Train Anthropic Models?

Agiloop accesses Anthropic models through Anthropic's commercial API rather than through a consumer AI product.

Under Anthropic's commercial terms, inputs and outputs submitted through its commercial products, including the Anthropic API, are not used to train its generative models unless the customer explicitly opts in to provide that data for model improvement.

Agiloop does not opt customer source code into model training.

Does Agiloop Store My Source Code?

No.

Agiloop does not retain the cloned source code used to perform an assessment.

The repository is cloned into temporary storage within the isolated analysis environment. Once processing is complete, the temporary repository is deleted and the analysis environment is discarded.

Your source code is not copied into Agiloop's persistent project storage or retained as part of the assessment.

How Does Agiloop Use My Source Code?

Your source code is accessed and processed only as necessary to provide the Agiloop services you request, including analysis using Agiloop's AI model providers.

Agiloop does not use customer source code to train models, create training datasets, develop features derived from your proprietary code, or for purposes unrelated to providing the Agiloop service.

Your source code remains your code.

What Does Agiloop Keep?

Agiloop retains the results of the assessment, not the source code used to produce it.

Assessment results are associated with your Agiloop project so that authorized project users can review findings and act on recommendations.

Assessment results remain available until they are:

• overwritten by a subsequent assessment where applicable;
• explicitly deleted by an authorized user; or
• removed when the Agiloop project itself is deleted.

Are Assessments Isolated Between Customers?

Yes.

Client code assessments execute in isolated environments. A project's temporary source code and analysis environment are isolated from other Agiloop customers and projects.

Each analysis environment is created for the assessment and discarded when processing is complete.

Source Code Lifecycle at a Glance

Your Repository

↓

Temporary, isolated Agiloop analysis environment

↓

Repository cloned to temporary storage

↓

Assessment performed using Agiloop-managed Anthropic API access

↓

Assessment results generated and stored in your Agiloop project

↓

Temporary repository deleted

↓

Analysis environment discarded

Agiloop retains the resulting assessment—not the source code used to perform it.

Frequently Asked Questions

Can Agiloop modify my repository?

No. Repository access used for onboarding and assessment is read-only. Agiloop does not require write access to modify your repository as part of the assessment process.

Is my entire repository copied?

The repository is cloned into the temporary analysis environment so the assessment can analyze the project's codebase. That temporary copy is removed when processing completes.

Is my source code permanently uploaded to Agiloop?

No. Source code required for an assessment exists temporarily within the isolated analysis environment and is not retained by Agiloop after the analysis completes.

Is source code sent to an AI provider?

As part of an assessment, source code and repository context may be provided to Anthropic's models as necessary to perform the requested analysis. Agiloop accesses these models using Agiloop-managed commercial API credentials.

Is my source code used for AI model training?

Agiloop does not use customer source code to train models or create training datasets, and Agiloop does not opt customer source code into Anthropic model training.

Can another Agiloop customer access my code?

No. Customer code assessments are isolated from other customers and their projects.

What happens to the assessment after the source code is deleted?

The generated assessment results are stored with your Agiloop project. This allows your team to review findings and recommendations without Agiloop retaining the underlying source code.

How can I revoke Agiloop's repository access?

You can remove the repository connection from the project's settings. Repository credentials may also expire or be revoked through your repository provider.

The Short Version

Agiloop requires read access to your repository to perform code-based assessments. When an assessment runs, your repository is cloned into an isolated, temporary analysis environment. Agiloop analyzes that temporary copy using its assessment tooling and Agiloop-managed Anthropic API access, stores the resulting assessment, deletes the cloned source code, and discards the environment.

Agiloop retains the assessment results—not your source code.