Trust boundary
What happens to your data
Pick a stage to see what it holds and what it refuses.
GitHub · Your repositories
- What it holds
- Your source. BuildIT reads only the repositories you selected when you installed the GitHub App, and public and private repositories use the same installation boundary.
- What it refuses
- It may maintain one BuildIT check and one summary comment on the reviewed commit, and open a separate stacked pull request after Autofix consent. It has no merge authority and does not edit workflows or repository settings.
Source is transported as short-lived encrypted artifacts in AWS Ireland. Isolated checks run in a Vercel Sandbox in Paris, France. Convex Ireland stores references and source-free review metadata rather than plaintext source.
What is not promised
BuildIT does not promise that AI makes code bug-free. Required test, scanner, commit, citation and staleness evidence decides the result, and missing or conflicting proof ends as inconclusive — never as ready to merge.
What is still thin is the track record: 141 pull requests over 7 repositories, 1 consecutive since the last platform failure on 2026-09-04. Enough to show the known failures are fixed; not enough to claim reliability on a codebase unlike those.