Data and permissions
Balladeer stores descriptions of behavior and bounded evidence about checks. Your source code, tests, fixtures, raw logs, prompts, and agent transcripts remain in your environment under the supported workflow. Your local coding agent can still read files using its own permissions.
What is stored or transmitted?#
| Information | How Balladeer uses it |
|---|---|
| Recorded and agreed behavior, cases, scope, ownership, and bounded review text | Records what the team is proposing or has agreed, and its history. |
| Workspace members and identity information | Establishes membership, ownership, and routing. |
| Repository, branch, workflow, connection, and machine metadata | Connects setup and evidence to the intended scope. |
| Closed CI outcomes, reason codes, commit identities, and content digests | Records what was checked and whether the result can be used. |
| Bounded discovery queries, retrieval feedback, and lifecycle records | Records access/use receipts and changes to the promise's history. |
| Promise code anchors: paths and symbol names | Shares where agreed behavior lives; no source text or full behavior map. |
| Agentic verdict, source/base commits, reproduction digest, and bounded provenance | Records a local check separately from sealed protection evidence. |
| Optional Slack integration credentials and routing information | Supports notifications for a connected workspace. |
Promise text is stored text, including proposals before agreement. It can contain sensitive business information. Do not paste credentials, raw source, logs, or transcripts into a proposal or case; the absence of repository-read access does not prevent a person from putting sensitive material in a text field.
Does meaning text go to model providers?#
When configured, discovery sends a bounded task description and selected meaning text to Voyage for embeddings and relevance ranking. Optional Anthropic processing can judge uncertain discovery matches or compare proposed meaning with similar promises. These processes are advisory: none approves meaning, proves complete coverage, or establishes protection.
Discovery's provider text excludes raw source, transcripts, literal source quotations, and example
artifacts. The separate paths query field stays on Balladeer's server rather than going to a model
provider. Do not put private file contents or raw prompts into the task-description field. Meaning
and task text can contain sensitive business information and are not necessarily anonymous.
Contact hello@balladeer.ai for your organization's current provider, processing, and retention configuration. A feature being optional in the implementation is not a claim that it is disabled in your workspace.
How do agentic checks use my model login?#
The local push check starts headless Claude Code or Codex on your existing login and uses that account’s usage allowance. It reads and executes customer code locally through that agent’s permissions; model processing follows your provider’s terms. It does not need a new API key. This differs from server-side processing of meaning for discovery.
Code anchors shared with Balladeer contain repository-relative paths and symbol names, never source text. Full behavior maps, reproduction files, raw outputs, and the local judge log stay on your machine. The service records bounded verdict metadata and digests; it does not receive the reproduction.
Can Balladeer read or write our GitHub repository?#
Balladeer does not hold a GitHub repository token or install a GitHub App to clone your source.
Setup uses your own locally authenticated gh to read repository identity and, on the administrator
path, prepare the workflow pull request.
Verification runs in your CI. The job executing customer code has no Balladeer credential or OIDC permission; the reporting jobs authenticate without checking out the source. Results carry bounded outcomes and digests instead of raw test output. This separation is not a claim of zero network egress or protection against arbitrary malicious code on the same runner.
The public Attestor repository contains the trust anchor used by customer CI. Review the exact released commit pinned by your generated workflow when evaluating it.
Who approves what?#
| Actor | Responsibility |
|---|---|
| Coding agent | Reads authorized context, drafts proposals, and prepares customer-local verification within the work requested. |
| Named meaning owner | Agrees the behavior and decides meaning changes and applicable lifecycle proposals. |
| Workspace administrator | Manages workspace access and repository setup; this role alone does not approve someone else's meaning. |
| CI and Balladeer | Validate bounded evidence; protection starts automatically when a verifier qualifies for agreed meaning. |
For initial meaning agreement, the named owner can review and explicitly agree the current proposal in their own connected agent conversation. The agent carries the displayed proposal digest and the owner's actual words; a changed proposal or different connection owner is refused. See the agreement steps.
Other authority-bearing lifecycle actions, and agreement through someone else's connection, require browser sign-off for the specific act and its one-time code. Ownership transfer has its own human review and acceptance requirements. Administrative access is not a blanket semantic override. An agent cannot turn its own assessment into human approval.
Where are credentials kept?#
The CLI stores its private connection outside the checkout, normally at
~/.config/balladeer/credentials.json, with restrictive file permissions. Do not copy it into the
repository or share it with teammates. Each machine establishes its own connection.
The temporary setup session and repository-scoped coding-agent credential have different lifetimes. The setup session expires after a day without use, extends with use, and ends at most seven days after approval. The coding-agent credential has no automatic expiry in this release; revoke it when access should end. Revoking a connection and changing promise ownership are different actions.
An optional Slack installation stores an encrypted bot token. “No GitHub repository credential” does not mean the service holds no integration credentials of any kind.
What happens when we leave?#
Export the workspace history before offboarding revokes hosted access. The export includes the customer record of promises, revisions, ownership, lifecycle changes, and bounded evidence; it excludes authentication secrets and raw customer-code artifacts.
Your tests, fixtures, and verifier packages remain in your repository and can be run independently. The workflow's hosted reporting path depends on active access, so plan any workflow changes needed to continue without that reporting service.
Export, disconnect, revocation, and data deletion are distinct. Offboarding is not a statement that stored history has been erased. Contact hello@balladeer.ai for the current retention and deletion procedure before making a retention commitment for your organization.
Security review#
Workspace-scoped application checks and database row-level security protect normal tenant access. They do not establish that privileged operators cannot access stored data. Request current operator-access, data-processing, retention, and assurance documentation from hello@balladeer.ai for your review. These product descriptions do not claim an external audit or certification.