// LLM disclosure

LLM Disclosure

Last updated: 2026-08-26

What it is

To describe what a repository is and how it is put together, CTO.ai builds a per-repo digest: a bounded selection of files is read from the repository and sent to Anthropic's Claude API, which returns prose sections (identity, architecture, conventions, and so on) plus an architecture diagram. Those sections are what the CTO agent reads for general repository context.

Two other flows also send code to the Claude API, and are covered by this disclosure:

• Pull-request review. When review is enabled for a workspace, the changed lines of a pull request (a bounded diff) are sent for review against your engineering standard.
• Escalated investigation. For a finding that needs deeper checking, the agent works in an isolated, short-lived checkout of the repository at one commit and may read files in it to confirm or refute that finding. File contents it reads may be sent to the model as part of that investigation.

When it triggers

A digest build runs when:

• You select a repository during onboarding
• A repository's digest has gone stale relative to its default branch and a refresh is scheduled

Each build is bounded by a per-repo spend ceiling, so a repository is never read in full and never re-read on every commit.

Privacy posture

When a digest is built, the selected file contents are transmitted to Anthropic over TLS. Anthropic's data-retention practices apply; at the time of writing, Claude API inputs and outputs may be retained for 30 days for abuse detection, then deleted.

We do not train models on your code, and Anthropic has committed that Claude API calls are not used to train their models.

The build always runs behind our Content Safety Layer: file contents are scrubbed for obvious secrets (API keys, private keys, passwords) before transmission, and every model response is scrubbed on receipt and again before it is stored.

Opt-out

There is no self-serve Settings toggle for this yet, and no per-workspace switch exists: digest building is currently controlled by a single platform-level deployment setting that applies to all workspaces. A per-workspace opt-out is planned but not built.

Pull-request review is per-workspace and is off unless you turn it on. If you need digest building disabled for your account before a per-workspace switch ships, email privacy@ctoai.live and we will configure it for you. With it disabled:

• No repository file contents are sent for digest building
• No digest is built, so no architecture diagram is produced
• The CTO agent still works, grounded on the signals it collects from the GitHub API (commits, pull requests, reviews) rather than on a description of your code

References

• Anthropic DPA
• Claude data-usage FAQ
• Our privacy policy: /privacy