Security, Privacy & Compliance

Last Updated: October 2026

At PSI Studio (operated by Julien Piron), security and confidentiality are first-class architectural constraints. When deploying autonomous AI agents to interact with proprietary codebases, trust must be verifiable, deterministic, and cryptographically sound.

1. Zero Customer Data Retention (ZDR)

No Training on Customer Code: Neither PSI Studio nor our foundation model partner Anthropic ever trains on your proprietary source code, task graphs, PR diffs, or execution logs.

API integrations strictly utilize commercial enterprise endpoints governed by zero-retention policies.

2. Model Context Protocol (MCP) Sandboxing

Agent tools operate exclusively within sandboxed, least-privilege environments:

Isolated Workspaces: File and tool manipulations execute inside ephemeral Docker microVMs or strictly scoped worktrees.
Explicit Permissions: Destructive operations (git push, db migrations, deployment commands) require explicit human-in-the-loop approvals unless dry-run flags are active.
Cryptographic Audit Trails: Every agent decision, tool execution, and code mutation is logged with SHA-256 hashes for total traceability.

3. Encryption & Transport Standards

In Transit: All web traffic and API endpoints require TLS 1.3 with strict HSTS preloading.
At Rest: Any cached repository metadata or ephemeral session tokens are encrypted using AES-256-GCM.

4. Compliance & Vulnerability Reporting

We adhere to European GDPR standards and prepare for SOC 2 Type II compliance. To report security vulnerabilities or request our full security whitepaper, contact our lead architect directly at: contact@julienpiron.com.