Where your data goes and who can access it

Five boundaries

Your organisation stands in every request

Not as a filter someone can forget, but as part of the record and of the request. For members of another organisation your data does not exist.

Your model key, your run

On the Claude paths nothing runs without your organisation's key; the request is rejected. For OpenAI-compatible providers your key overrides a configured default.

Keys are stored encrypted

Your credentials are stored encrypted, not in plain text. The service refuses to start at all if the key for that storage is missing.

Foreign code builds in a throwaway pod

Generated code is executed when it is built and tested. That happens in an unprivileged, throwaway pod, never in the coordinator: where the code can reach nothing.

Your repository token never leaves the coordinator

The worker does not see your token. It clones and pushes through an in-cluster address, and only there is the credential applied. All it carries is a short-lived pass the coordinator issues per run for exactly your organisation and project; the generated code cannot issue itself one.

Why failing is the right default

The convenient construction is the opposite one: if a key is missing, take the shared one; if the organisation is missing, show everything. Both conveniences are invisible in normal operation and, in the failure case, are the damage itself. Anvil Coder decides the other way at the five points above: if something is missing, it stops. That is more annoying during setup, you notice immediately when something is missing, and exactly therefore correct.

If you run Anvil Coder yourself, these switches are in your hands: the storage key and the secured security mode have to be set for the five boundaries to hold as they do in the rented service.

Where the data lives

The service runs on the Infomaniak Public Cloud in Switzerland. For teams that have to justify data sovereignty, that is not a side note but often the first question.

The models live with their providers; whatever goes into the prompt, they see. The connection is interchangeable and covers local models via Ollama, which provider runs is a deployment decision. If you set a price per unit of compute time for local models, runtime flows into the cost accounting; without a price they run at cost zero.