Security at Tachyon

You're trusting us with access to your source code. Here's exactly how we handle that responsibility.

Code access and handling

Tachyon connects to your repositories through a GitHub App with read access to code and write access limited to pull request comments. It cannot push code, modify branches, or change repository settings.

When a scan runs, your code is pulled into an isolated sandbox environment created specifically for that analysis. Code is never written to persistent storage or shared infrastructure. When the analysis completes, the sandbox is destroyed — along with all copies of your code.

We do not retain your source code after analysis. The only outputs that persist are the security findings and review comments we generate for your use.

Analysis architecture

Each analysis runs in a dedicated, isolated sandbox, never shared across organizations, repositories, or scan runs. Each one is provisioned on demand and torn down after use.

The analysis is agentic: large language models read your code and, where possible, execute code paths inside the sandbox to validate that a finding is exploitable.

LLM and data policy

Tachyon uses Claude (Anthropic) as its underlying language model. Code sent to the LLM is handled under Anthropic's commercial API terms and is not used to train models.

Security findings, PR review comments, and scan metadata are stored in Tachyon's database so you can access your results. You can request deletion of this data at any time.

Compliance

We're building toward SOC 2 Type II certification. Our current security controls include:

  • Encrypted data in transit (TLS) and at rest
  • Role-based access control with least-privilege defaults
  • Ephemeral sandboxes, torn down after each analysis
  • No persistent storage of your source code
  • LLM calls under Anthropic's commercial API terms; no model training on your code

If you have specific compliance requirements (SOC 2, ISO 27001, GDPR), we're happy to discuss our controls and roadmap in detail.

Responsible disclosure

If you discover a security issue in Tachyon itself, report it to [email protected].

Tachyon's own disclosures to open-source maintainers, including CVE-2025-14297 in MLflow, are published on the research page.

Questions about our security posture?

We can walk through this page line by line on a call.