Security & Trust

Our approach

CodeLynq connects to your source repositories and runs an AI coding agent against them, so security is foundational to the product rather than an afterthought. This page summarizes how we protect your code, credentials, and data.

Data encryption

All traffic is served over TLS 1.2+. Secrets at rest — repository access tokens, organization API keys, and multi-factor secrets — are encrypted with authenticated symmetric encryption (Fernet/AES). Passwords are hashed with bcrypt and never stored in plaintext.

Repository access & isolation

You grant access per repository with a scoped token or OAuth connection, and you can revoke it at any time. Development runs execute in an isolated environment with a minimal secret footprint — a run only receives the repository token and model credentials it needs, never your platform or database secrets. Organizations can also run the agent entirely on their own infrastructure with a self-hosted runner, so your source never leaves your environment.

Authentication & access control

We support single sign-on with your own identity provider over OIDC or SAML 2.0, SCIM user provisioning and de-provisioning, enforced SSO per email domain, and TOTP-based multi-factor authentication. Access is role-based at the organization level, and sessions are individually revocable.

Auditability

Every sensitive action — logins, member and permission changes, runs, billing events, and administrative operations — is recorded in a tamper-evident audit log that organization admins can view and export. Audit records capture the actor, action, and source IP.

Data processing & GDPR

CodeLynq is operated from the EU and built for GDPR compliance. You can export your data and delete your account or organization at any time. Content you submit may be processed by our AI subprocessor to provide the features you request; organizations may supply their own model API key to keep processing under their own agreement. Our data processing agreement applies automatically; email info@northdock.eu if you need a signed copy.

Subprocessors

We use a small, vetted set of subprocessors to deliver the service:

• Leaseweb Netherlands B.V. (the Netherlands) — hosting of the application and database.
• Amazon Web Services EMEA SARL (Amazon SES, Frankfurt) — delivery of service emails.
• Anthropic (United States) — AI model inference for specifications and code, unless the organization uses its own API key.
• Mollie B.V. (the Netherlands) — payment processing.
• Odoo — billing, invoicing and support tickets.
• Scaleway SAS (France) — only for projects that use CodeLynq managed hosting.
• OpenAI (United States) — only for speech-to-text when voice input is used without the browser's own speech recognition, and for the Codex agent when an organization chooses it.
• xAI (United States) — only for the Grok agent, when an organization chooses it.
• Google Ireland Limited (Ireland, with processing in the United States) — Google Analytics website and app statistics, only after you consent to analytics cookies.

Integrations you connect yourself (GitHub, GitLab, Bitbucket, Fireflies, Plaud) are not our subprocessors: they act on your instructions under your own agreement with them. We announce changes to this list in advance, as set out in the data processing agreement.

Reporting a vulnerability

If you believe you have found a security issue, please email our security form. We investigate all reports and will acknowledge receipt promptly.