security & data access

# What we touch. What we keep.

Telemetry access is read-only. Perfloop can read metadata, metric series, log aggregates, and sampled profiles within the scope you connect. Loki queries can also return log text within set time and size limits. Axiom and Datadog raw event rows stay with the provider. On code, writes are limited to approved branches and pull requests. Perfloop cannot merge, approve, or deploy a change.

connection reads and writes are bounded by your grants and visible in provider audit logs where supported

## *The data contract.*

You choose the repositories and exact telemetry resources. Each connection guide explains the permissions it needs and the data it can read.

Data access by category

| category | what crosses the boundary | what perfloop keeps | retention |
| --- | --- | --- | --- |
| telemetry · metrics & logs *read-only* | schema metadata, labeled metric series, time-bounded log aggregates, and bounded Loki log entries, including authorized labels and grouping values | connection scope, query definitions, captured results, and derived model or proof evidence | while the customer account is active |
| telemetry · profiles *read-only* | sampled stacks, values, labels, function and file names, build identifiers, and profile files; Google reads Cloud Profiler profiles across the selected project before target and time selection | capture receipts, stack previews, and selected profiles that model tools can inspect as proof artifacts | while the customer account is active |
| source code *read + pr write* | code in repos you connect; writes are approved branches and their pull-request surfaces, never a merge or deployment | repository metadata, code-derived model, session transcripts, tool records, proposed changes, and proof artifacts | while the customer account is active; rebuildable caches 7 days |

current retention · active product records remain while the customer account is active · an authorized account deletion stops access and removes live data after a selected 1-to-30-day recovery period · database recovery copies expire after 7 to 30 days · object recovery copies expire after 30 days

not requested as separate inputs

- unbounded telemetry row access Axiom and Datadog reject raw-row queries before egress. A bounded Loki range read can return authorized log text with fixed entry, time, and byte limits. Metric labels, grouping values, log text, and profile labels can contain sensitive values. Scope the source before you connect it.
- automatic resource expansion You name or select each connected resource. The Grafana setup picker can list datasource names, types, and IDs visible to your grant. Selecting one does not connect the others. Google access covers Cloud Profiler profiles across the selected project, with no permission for other resource types.
- upstream provider credentials The sandbox does not hold credentials for code hosts, telemetry sources, or model providers. Connected source code can still contain secrets, so use normal secret-hygiene controls.
- merge or deployment authority The GitHub proxy rejects merge, approval, request-changes, and draft-state mutations. Perfloop has no deployment connector.

## *Connections and residency.*

What you connect and where Perfloop runs are separate, independent choices. Each connection is its own grant and can be revoked at its provider. Revocation stops new provider reads; product-data deletion is separate. Nothing is connected by default.

### what you connect

1. #### code host

   *Read access plus bounded writes on repositories you select: approved branches; PR creation and title or body updates; comments, comment-only reviews, replies, and review requests. Perfloop cannot merge, approve, request changes, or change draft state.*

   benchmarks run in perfloop's sandbox · every write is bound to the approved branch or pull request
2. #### telemetry source

   *Read access to resources you name or select: schema metadata, labeled metric series, log aggregates, and sampled profiles. A setup picker can show resource metadata. Google access covers Cloud Profiler profiles across the selected project.*

   read-only provider grant + customer-selected resource scope are the confidentiality boundary · aggregate validation is defense in depth

### where perfloop runs

1. #### our cloud

   *One workspace per customer on shared infrastructure.*

   the default · product data is stored in our gcp deployment · selected model context goes to the providers below
2. #### your cloud

   *Product storage can run in a project you provision. Approved inference providers still receive selected model context.*

   not generally available · requires a current-release acceptance review and separate agreement

the soc 2 type ii report is not issued · the current observation status is below

## *Connection guides.*

Use credentials with read-only access to the resources you want to connect. Perfloop checks that it can read those resources, but cannot inspect every permission the credential holds. Remove broader roles before you connect. The data Perfloop receives can include labels, grouping values, and profile metadata.

Provider permissions control which data a credential can access. Google Cloud Profiler, for example, returns profiles for the whole project before Perfloop filters them by workload and time. Use a separate project to restrict which profiles it can receive. Each guide explains the permissions and data for that source.

- [GitHub Fine-grained app on repositories you select. Writes are bound to approved branches and their PR surfaces; merge and approval are blocked.](https://perfloop.ai/docs/connect/github)
- [Axiom Query aggregates from the Axiom datasets and saved views you choose.](https://perfloop.ai/docs/connect/axiom)
- [Prometheus Read metrics from your Prometheus endpoint, filtered by service or environment.](https://perfloop.ai/docs/connect/prometheus)
- [VictoriaMetrics Query metrics from a single-node or cluster deployment.](https://perfloop.ai/docs/connect/victoriametrics)
- [Pyroscope Read profiles for the services you select in Pyroscope.](https://perfloop.ai/docs/connect/pyroscope)
- [Loki Query logs and log metrics from selected Loki streams.](https://perfloop.ai/docs/connect/loki)
- [Google Cloud Profiler Read profiles from one Google Cloud project with a dedicated service account.](https://perfloop.ai/docs/connect/gcp)
- [Datadog Connect metrics and log aggregates. Use API keys to add Go CPU profiles.](https://perfloop.ai/docs/connect/datadog)
- [Polar Signals Read profiles for selected workloads in a Polar Signals project.](https://perfloop.ai/docs/connect/polar-signals)
- [Grafana Connect Prometheus, Loki, or Pyroscope through your Grafana stack.](https://perfloop.ai/docs/connect/grafana)
- [Grafana Cloud Authorize access to a Prometheus or Loki data source in Grafana Cloud.](https://perfloop.ai/docs/connect/grafana-cloud)

[all connection guides](https://perfloop.ai/docs/connect)

## *Agent containment.*

The agent runs your code and reads your telemetry, so the architecture treats it as compromised and contains it.

the agent is treated as compromised

- sandboxed sessions Every session runs in its own hardened, ephemeral sandbox (gVisor), destroyed when the session ends. Its only credential is a short-lived token that tells the proxy which session it is; the token grants nothing by itself, and the sandbox can't reach the infrastructure it runs on.
- upstream secrets stay outside The sandbox holds no upstream credentials for GitHub, model providers, or your telemetry. It receives only a short-lived session proxy token; the proxy attaches upstream credentials after route and grant checks pass.
- one path out Deny-by-default networking. The only route out of the sandbox, DNS included, is the proxy.
- permissions enforced in the proxy Host, method, and path allowlists plus per-session grants, checked deterministically outside the model. GitHub writes are bound to the approved branch and PR; merge, approval, request-changes reviews, and mark-ready are denied at the proxy.

## *The control plane.*

Containing the agent is half of it. The platform that holds your derived data is itself least-privilege.

least privilege by default

- private database The product database has no public address and refuses unencrypted connections. Access is over TLS from inside the private network only.
- encrypted at rest All stored data is encrypted at rest with platform-managed keys.
- scoped credentials Third-party credentials are held only by the service that uses them, never by the agent. The code-host key lives in the egress proxy, which obtains short-lived installation tokens scoped to approved repositories. No session holds a raw GitHub token.
- least privilege between services Control-plane services are deny-by-default on the network, every path explicitly allowed. The session controller can verify callers and manage sandboxes, and nothing more: no exec into workloads, no privilege escalation, no impersonation.
- managed secret store Static service secrets and encryption keys live in a managed secret store. Customer connection credentials are stored as encrypted database envelopes that only the proxy can open. The agent never receives those credentials.
- audit retention floor Routine audit rows are retained for at least 403 days. Tenant deletion removes tenant-owned audit rows at its deadline. One aggregate closure record stays outside routine reaping: tenant handle, deletion actor and dates, Session and token totals, provider cost, and customer-priced Usage. It contains no customer content or raw usage events.

## *The questions your security team will ask.*

Answered up front, against ground truth.

1. 01

   ### Does our raw data ever reach an LLM?

   Yes. **Connected source code**, prompts, and tool results can enter model context. Case, triage, and model-build sessions currently use **OpenAI**. Controller and operator tasks use **Google Vertex AI**. OpenAI Responses requests set store=false; this is not a zero-data-retention claim, and OpenAI's applicable abuse-monitoring retention can still apply. Commonplane does not use customer content to train models. Schema metadata, metric series and labels, log aggregates, and profile previews can enter model context. Models can also use standard tools to inspect the full retained profile files. Tool output can include function and file names, build identifiers, labels, and sampled values. Bounded Loki reads can return authorized log entries and log text. Axiom and Datadog do not provide raw log or event rows.
2. 02

   ### What happens if your agent is prompt-injected?

   Assume it happens; the architecture does. The session holds **no upstream provider credentials** and has **one network path**: the proxy, where destination allowlists, per-session permissions, and credential injection are enforced outside the model. A hijacked agent gains no provider credentials, no new destinations, and no way to merge anything, and every request it makes passes through the proxy's route checks.
3. 03

   ### Who are the subprocessors?

   **Google Cloud** hosts the product and provides Vertex AI inference for controller and operator tasks. **OpenAI** provides inference for case, triage, and model-build sessions. **WorkOS** authenticates users and stores account data such as name, email, and IP address. **Axiom** holds operational logs, traces, and metrics. A tenant setting that is off by default can enable diagnostic capture of customer or source-derived agent content, which Perfloop classifies as Customer Confidential. When you connect a telemetry account, Perfloop queries that customer-authorized service under the grant and resource scope you provide.
4. 04

   ### Can Perfloop employees see our data?

   Authorized Commonplane personnel can access customer data when needed to operate, secure, diagnose, or support the Service. Access uses authenticated product and operator paths. Provider grants remain bounded by the scope you gave Perfloop. Revoking a provider grant stops new reads but does not delete records already stored in the Service.
5. 05

   ### What happens when we revoke?

   Remove repositories from the GitHub App or uninstall it to stop GitHub access. GitHub enforces the changed repository grant on installation tokens. Revoke the telemetry grant at its provider to stop new telemetry reads. These actions do not delete product records or artifacts already stored by Perfloop; an authorized tenant deletion removes those under the retention process above.
6. 06

   ### How do you know what data you need before seeing our telemetry?

   You name or select each resource before connection. The Grafana setup picker can list datasource metadata visible to your grant. Perfloop then reads schema, metrics, log aggregates, or profiles within the selected scope. Google lists Cloud Profiler profiles across the selected project before local filtering; it has no permission for other Google resource types. Perfloop does not add resources on its own.

## *Status.*

This page documents what Perfloop accesses and how that access is controlled, in claims you can verify today. Formal attestations are in progress; their status is below.

**architecture review**

available now

This page, the full data-access specification, and a founder walkthrough with your security team.

**soc 2 type ii**

observation period

Type II observation is in progress. Audit-ready as of 15 August 2026. No Type I. The report is not issued. We are not certified.

**dpa**

in preparation

We are preparing the first standard Data Processing Addendum with counsel.

**byoc**

not generally available

Requires a current-release acceptance review and a separate enterprise agreement.

## *For your* *security team.*

full specification + security questions: [*security@perfloop.ai →*](mailto:security@perfloop.ai?subject=Security%20review)