Security
Nythrex security: metadata only, read-only, encrypted
Nythrex sees what the work cost, but not the work itself. Code, prompts and file names never leave developers’ machines, access to sources is read-only, and everything that is stored is protected by encryption and roles.
Code, prompts and file names are not stored.
Metadata only
Access to sources is read-only.
We change nothing
Tokens are encrypted, keys live in Azure Key Vault.
Encryption
Minimal data by design
The best data protection is not collecting the data at all. Nythrex receives only what cost tracking needs:
| We receive | We do not receive |
|---|---|
| commit and pull request metadata: SHA, author, time, branches, size of change | code contents, diffs and files |
| time, model and tokens of AI requests, cost, session ID | prompt and response text |
| task states and dates, task descriptions as plain text | attachments, comment and review text |
| daily cloud cost by resource group and service | the contents of cloud resources |
Codex adds tool arguments and output snippets to its telemetry — Nythrex drops them on arrival without storing them.
How stored data is protected
Token encryption
OAuth access and refresh tokens are stored encrypted (ASP.NET Core Data Protection); the keys are protected by a key in Azure Key Vault.No passwords between services
Azure services talk to each other through managed identities. Integration client secrets live in Key Vault.Workspace isolation
The data of different workspaces is isolated, and access inside a workspace is limited by role: owner, admin, member.Transport
All traffic goes over HTTPS with HSTS. The site and the app enforce a Content Security Policy.
Accounts and access
- passwords are stored only as hashes (ASP.NET Core Identity);
- after 5 failed attempts sign-in is locked for 15 minutes;
- a sign-in session lasts 12 hours; cookies are HttpOnly and Secure, with CSRF protection;
- only members with a confirmed email can invite colleagues, and the number of invitations is limited;
- AI tool tokens are valid for 90 days, their number per workspace is limited, and membership is checked on every upload;
- API requests are rate-limited, including those with unknown tokens.
Monitoring and process
- SQL auditing and threat protection are enabled at the database server level;
- service security logs are collected in a separate store with alerts on access denials and changes to audit settings;
- deployment is allowed only from the main branch, and third-party CI actions are pinned to immutable versions;
- dependencies are regularly checked for known vulnerabilities;
- secrets have an owner and a review date; the app warns ahead of their expiry.
常见问题
Where is the data stored?
In Microsoft Azure, Poland Central region (EU): Azure App Service, Azure SQL Database and Azure Key Vault.
Is Nythrex SOC 2 or ISO 27001 certified?
We do not claim certifications we do not have. This page describes the measures that actually run in the product; if your company needs a security questionnaire, book a call.
Who at Nythrex can access a workspace’s data?
The operator console shows aggregates only, never the contents of records: it reads a separate database schema through its own managed identity.
What happens when a developer leaves the team?
Removing a member from the workspace revokes their AI tool tokens and approved device requests. Membership is checked on every telemetry upload.