Security for the work your business runs on.

What happens to your code

Bohmian is designed so customer code is processed only to provide the service, subject to the customer's agreement and retention settings.

• Processed to generate findings — code is analyzed to produce verification findings and evidence records.
• Not used to train foundation models — Bohmian does not use customer code to train third-party foundation models.
• Opt out of secondary use — customers may opt out of any AI training or use beyond service delivery.
• Deletion on request — customers may request deletion of submitted data.
• Retention policies — customers may request retention policy settings for their account where supported.

Processing and storage occur in Bohmian's cloud environment and configured subprocessors. Enterprise customers may request details during security review.

Retention and deletion terms are governed by our current Terms of Service and Privacy Policy.

Subprocessors

Bohmian uses a small set of subprocessors to operate the service, including cloud hosting, GitHub integration, model inference providers, monitoring/logging, email delivery, and payment processing. Enterprise customers may request the current subprocessor list during review.

• Cloud hosting provider
• GitHub (source integration)
• Model inference provider(s)
• Monitoring and logging
• Email / transactional messaging
• Payment processing (billing only)

Where available, Bohmian uses model provider configurations or contractual terms designed to prevent customer code from being used for model training.

Data protection

Private repository contents are never publicly exposed. Hosting region details are available to enterprise customers on request.

Authentication and access

Enterprise customers may use SSO/SAML where supported. API access is controlled through scoped API keys that can be rotated or revoked. Bohmian applies rate limits and internal least-privilege access controls, with MFA required for sensitive internal systems.

• SSO/SAML — available for enterprise customers.
• Scoped API keys — keyed to customer/account/org use, with rotation and revocation.
• Rate limits — applied to protect the service.
• Internal least-privilege — combined with MFA for sensitive internal systems.
• Admin controls — organization admins manage members and access.

Customer controls

You stay in control of what Bohmian processes and retains.

• Disable repositories in Bohmian to stop future processing and credit usage.
• Request deletion of submitted data.
• Set or request retention policies for your organization.
• Opt out of AI training or secondary use beyond service delivery.
• Rotate or revoke API keys.
• Manage GitHub App repository access directly in GitHub.

Compliance posture

Bohmian is currently pre-SOC 2. We support enterprise security reviews and can provide a DPA and CAIQ-style security responses on request. Bohmian is designed to support privacy obligations under frameworks such as GDPR and CCPA, subject to the applicable customer agreement and data processing terms.

• SOC 2 — currently pre-SOC 2.
• DPA — available on request.
• CAIQ — CAIQ-style responses available on request.
• GDPR / CCPA — designed to support these obligations, subject to the customer agreement.
• Security questionnaires — enterprise questionnaires accepted.

Incident response

Bohmian maintains an incident response process for identifying, triaging, investigating, and remediating security events. If we determine that a security incident affects customer data, we will notify affected customers in accordance with applicable law and contractual commitments.

Vulnerability disclosure

To report a vulnerability, contact info@bohmian.ai.

Please include a description of the issue, the affected endpoint or workflow, reproduction steps, and any relevant screenshots or logs. Do not access, modify, or exfiltrate data that does not belong to you.