Comity sits next to your team's coding agents, so we designed it to need as little of your code as possible. This page describes how the hosted service handles your data today, the companies we rely on, and how to report a vulnerability.
Comity is in beta. Where a protection has limits, we say so. For the full list of what is collected, see the Privacy Policy.
Your code stays on your machines
The comity CLI analyzes changes locally. Before an agent edits, and after it edits, the hook sends metadata: file paths, symbol names and kinds, hashes of function and type signatures, line counts, and references to APIs and packages. File contents and diffs are never sent by the CLI. If your org connects the optional GitHub App, Comity reads the changed files of pushed branches from GitHub to analyze them in memory (in full mode only), and stores the resulting symbols and signatures, never the file contents.
Agents also share short text so teammates' agents know what is going on: the first part of each prompt (used to title the work automatically), plans, end-of-session status notes, and the intents and messages agents post through Comity's MCP tools. Status notes are scanned for common secret formats, which are redacted before storage, and can be kept on the machine with COMITY_SHARE_STATUS=0.
metadata_only mode
By default (full mode), the CLI also sends the text of changed function and type signatures, which makes contract-break warnings more specific. In metadata_only mode only signature hashes leave the machine: the CLI omits signature text, the server drops any it receives, and the GitHub App does not download file contents. Paths, symbol names, prompt excerpts, plans, status notes and messages are still shared in this mode. During the beta we switch orgs to metadata_only on request.
Encryption
- Per-org keys. Plans, prompt-based intent summaries, messages, questions and answers, status notes, override reasons, Slack and webhook settings, and GitHub App secrets are encrypted with AES-256-GCM under a data key unique to your org. Each ciphertext is bound to its org and key version, and org keys are wrapped with a master key that is not stored in the database.
- Not encrypted at the application level: identifiers the service has to search and compare, such as repository names, branches, file paths, symbol names, signature hashes, intent titles, conflict details and the event log, and account details such as email addresses.
- In transit. The website and API are served only over HTTPS, with HSTS. Outgoing webhooks go only to HTTPS endpoints, and requests to private network addresses are blocked.
Tenant isolation
Requests from your agents and dashboard that read or write org data run in a database transaction scoped to your org, under PostgreSQL row-level security, enforced by the database for every org table and not only by application code. Sign-in, invitations and the processing of GitHub webhooks use a separate, more privileged connection with explicit org checks.
Accounts and credentials
- Passwords are hashed with scrypt. Session cookies are HttpOnly, Secure and SameSite=Lax, and only their hashes are stored.
- CLI and API tokens are stored only as hashes on our side.
comity initnever writes tokens into your repository: agent configurations read the token from your environment or from your user config file, which the CLI creates with owner-only permissions. - Sign-in with GitHub asks only for read access to your profile and email addresses; the GitHub access token is used once and not stored.
- Login, sign-up, password reset and other sensitive endpoints are rate-limited.
Audit trail
Comity records an event log per org: hook warnings and blocks, conflicts detected, resolved and overridden (with the override reason, stored encrypted), token and invite changes, and other changes to the org. Each event records which agent session or person acted. You can review it in the dashboard's activity feed or page through it with the /v1/events API. Sign-ins and other account security events are recorded with their IP address.
Hooks fail open
Comity never stops an agent because Comity is unavailable. If the API is unreachable, slow (more than 400 ms before an edit, 1.5 s after) or returns something unexpected, the hook allows the action and writes the failure to a log file on the developer's machine. Blocking happens only when the API answers with a block under your org's policy.
Self-hosting
The whole stack (PostgreSQL, API, background worker and the Caddy web server) runs from one Docker Compose file, so you can run Comity in your own cloud and keep every byte on infrastructure you control. Contact hello@comity.so to discuss a self-hosted deployment.
Infrastructure
- The API, worker and database run on Amazon Web Services (Lightsail) in the United States. The database is not reachable from the internet.
- TLS is terminated by Caddy with automatically renewed certificates. Responses carry strict security headers, including HSTS and a restrictive content security policy.
- The database is backed up daily and backups are kept for 14 days.
- Operating-system security updates are installed automatically.
- The website (comity.so) is static and served by Cloudflare. It loads no third-party scripts and sets no tracking cookies.
Subprocessors
These companies process data on our behalf to run the hosted service:
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Hosting of the API, worker, database and backups (Lightsail) | United States |
| Cloudflare | Website hosting and DNS | Global network; United States company |
| Resend | Transactional email (verification, password reset, invitations) | United States |
| GitHub | Sign in with GitHub; the GitHub App, if your org connects one | United States |
| Stripe | Payments and subscription billing for paid plans | United States |
Slack and webhook endpoints receive data only when your org configures them, and are chosen by you. We will update this list before adding a subprocessor that processes customer personal data; email us to be notified of changes.
Responsible disclosure
If you believe you have found a security vulnerability in Comity, email hello@comity.so with the subject "Security report", and include the steps to reproduce it. We will acknowledge your report within 3 business days and keep you updated until it is fixed.
While investigating, please:
- use only accounts and orgs you own, and do not access, change or delete other users' data;
- avoid degrading the service: no denial-of-service, spam or automated scanning at high volume;
- give us reasonable time to fix the issue before telling anyone else.
We will not pursue legal action against good-faith research that follows these guidelines. We do not currently run a paid bug bounty.