Data handling & privacy

TheSpider does not upload your source tree. The agent runs a command in the checkout and sends git metadata plus model output. A cloud-backed model CLI may still send code to its own provider. That is a separate policy.

What the server gets

The rendered prompt goes the other way, agent-ward. Results echo only its SHA-256. Prompts and output are also stored as artifacts.

TheSpider does not get the source tree as a payload, and does not get the API keys your local CLI uses.

Never put credentials in a git remote URL. That URL is stored.

Secrets in evidence

A finding about a leaked secret can include the secret itself in stdout. Three layers:

1. Server scrubber (always on) for parsed findings, before they are stored as reports. It does not scrub raw stdout artifacts.
2. --redact on the agent (opt-in) masks secret-shaped strings and caps stdout at 1 MiB before upload. That is the control that protects the raw artifact. Truncation can clip the findings marker and make a slice look empty.
3. Lease logs on your own machine. The agent keeps a per-lease run log on your machine under its data directory: the model's stdout and stderr, plus a small metadata and result record. Nothing is uploaded; this is separate from the artifact the server already stores. --redact governs that local copy by exactly the same rule it applies before upload, so the flag means one thing everywhere. There are two rules and no others:
   • stdout follows --redact on both sides. Without the flag, the log holds the model's raw stdout, streamed as it arrives — that is what makes log show --follow live. With the flag, the log holds the same masked, 1 MiB-capped buffer that is uploaded.
   • stderr is raw on both sides. --redact has never masked stderr for the upload, and it does not mask the local copy either.
   
   Under --redact the payload is not live: nothing reaches the disk while the model runs, and both files are written once, when the model exits, so log show --follow reports the lease's state and liveness during the run and delivers the output at the end. That is a deliberate trade, and --redact is off by default.
   The local stderr.log holds the model's complete stderr, while the upload carries only its last 4000 bytes — the local copy is the bigger exposure of the two, not the smaller. Both local streams are capped at 32 MiB each; past that the agent stops appending and records the truncation in the result record.
   On Unix the log directory is 0700 and its files are 0600; on Windows they inherit the parent ACL, and note that %APPDATA% roams — set THESPIDER_LOG_DIR to keep multi-megabyte transcripts out of a roaming profile. Treat these files exactly as you would treat the raw artifact on the server. Nothing sweeps them: thespider-agent log clean is the collector, and THESPIDER_NO_LOGS=1 turns lease logging off entirely.

The server-side scrubber in layer 1 is unrelated to either --redact case: it always runs on parsed findings, never on raw stdout artifacts, and never on anything the agent keeps locally. Details: the agent.

Cloud signup answers

Cloud email signup asks for a name, account type, role, and primary intent (business accounts also give a company name and size band). Those answers sit on the account record so we know who uses the product. They are not used for marketing, not returned in session payloads, and not shown in org or project UI. On-prem signup does not collect them.

Retention

There is no self-service project or finding delete in the UI or public API. SaaS deletion is operator-assisted. On-prem customers control their own Postgres and storage.

Org and project data is scoped in the application and in Postgres. On-prem is single-tenant on your database. See on-prem.

The dashboard feedback form sends type, title, description, current path, and your email only when you submit it.