// LLM disclosure

LLM Disclosure

Last updated: 2026-09-10

What it is

To describe what a repository is and how it is put together, CTO.ai builds a per-repo digest: a bounded selection of files is read from the repository (READMEs, docs, manifests, configuration and CI files, then a small sample of source entry points) and sent to Anthropic's Claude API in a map/reduce (several summarizing calls, then one call that assembles the result), which returns six sections (identity, architecture, conventions, docs summary, hotspots and activity, and a symbol map) plus an architecture diagram. Each section is stamped with the commit it describes and cites the files it read. Those sections are what the CTO agent reads for general repository context.

Other flows also send repository-derived content to the Claude API, and are covered by this disclosure:

• Pull-request review. When review is enabled for a workspace (it is off by default), the changed lines of a pull request (a bounded diff, with credential-store files skipped and the rest scrubbed) are sent for review against your engineering standard. The model's comment is checked against the diff and scrubbed again before it is posted to GitHub.
• Rule-compliance grading. Where enabled for a workspace, on pushes to the default branch, and on pull requests in workspaces that have review turned on, the text of your engineering rule files (CLAUDE.md, AGENTS.md, .cursorrules), the paths of changed files, and analyzer findings are sent so the change can be graded against your written rules; file contents are not. Where the judgment pipeline is enabled, a bounded diff of the changed files (secret-scrubbed and size-capped), together with those rule files, may also be sent for a tool-less verification pass.
• Escalated investigation. For a finding that needs deeper checking, the agent runs in an isolated, short-lived working directory on our servers that holds only that finding's context (repository name, commit, file path, rule, and severity) and a task contract, not a copy of the repository. Its only tools are read-only file tools over that directory. We then fetch the cited file at the commit under review from GitHub to check the agent's evidence deterministically; that file is not sent to the model.
• CTO agent chat and reports. Your messages, the digests, your workspace settings, and the activity metadata we already hold (commits, pull requests, reviews, findings, decisions) are sent when you chat with the CTO agent or when it writes a report.
• Research. "State of the art" suggestions send the identity section of each digest (a short description of the repository and its stack) together with the repository name, and the model uses Anthropic's web-search tool; the search queries are composed by the model from that description, and repository file contents are not part of the request. Weekly research reads public sources from an allowlist and summarizes them; it does not send repository contents.
• Dossiers. Where nightly dossier synthesis is enabled on our deployment, the evidence records of recent judgments (findings and the patterns behind them, not file contents) are sent to produce repository and contributor dossiers.

When it triggers

A digest build runs when:

• You select a repository during onboarding
• A repository's digest has gone stale relative to its default branch and a refresh is scheduled. A refresh is incremental: only the sections the changed files affect are rebuilt, and the rest keep their existing content and commit stamp.

Each build is bounded by a per-repo spend ceiling, so only a bounded selection of files is read, and a repository is not re-read on every commit.

Privacy posture

When a digest is built, the selected file contents are transmitted to Anthropic over TLS. Anthropic's data-retention practices apply; at the time of writing, Claude API inputs and outputs may be retained for 30 days for abuse detection, then deleted.

We do not train models on your code, and Anthropic has committed that Claude API calls are not used to train their models.

Before anything is read into a prompt, files whose purpose is to hold credentials (.env files, private keys, credential stores) are skipped entirely. Everything that is read is scrubbed by pattern matching for known credential formats (API keys, tokens, private-key blocks, and credential-style assignments), and digest sections and review comments are scrubbed again before they are stored or posted. Scrubbing is a safety net, not a guarantee: a secret in an unfamiliar format can pass through it.

Opt-out

There is no self-serve Settings toggle for this yet, and no per-workspace switch exists: digest building is currently controlled by a single platform-level deployment setting that applies to all workspaces. A per-workspace opt-out is planned but not built.

Pull-request review is per-workspace and is off unless you turn it on. If you need digest building disabled for your account before a per-workspace switch ships, email privacy@ctoai.live and we will configure it for you. With it disabled:

• No repository file contents are sent for digest building
• No digest is built, so no architecture diagram is produced
• The CTO agent still works, grounded on the signals it collects from the GitHub API (commits, pull requests, reviews) rather than on a description of your code

References

• Anthropic DPA
• Claude data-usage FAQ
• Our privacy policy: /privacy