What leaves your infrastructure

This is the operational detail behind the Security page, precise enough to answer an InfoSec questionnaire, not just to make the case.

Three destinations, nothing else

Your code and ticket data can leave your instance in exactly three ways:

1. The model provider you choose: Anthropic, or Bedrock/Vertex AI/Foundry on enterprise deployments.
2. Your git remote: the actual change, pushed or opened as a pull request.
3. Configured integrations: notifications you've connected (email, Slack, webhook) and trackers you've connected (GitHub, GitLab, Jira, Linear).

Your code is sent only to the model provider you choose, as working context for the ticket being worked on. Nothing is proxied through Reqursor's own infrastructure, and nothing goes to a destination you didn't configure.

What each destination actually receives

• The model provider gets the ticket title, description and acceptance criteria, plus the file paths and excerpts the agent reads or writes while working the ticket. That provider's own terms govern what they do with it from there. It's worth reading Anthropic's (or your cloud provider's), since that agreement is between you and them.
• Your git remote gets the diff itself, as a commit or a pull request, no different from pushing it yourself.
• A connected notifier gets only what you'd expect a notification to contain: ticket titles, ship/no-ship outcomes, and blocker summaries.
• A connected tracker gets standard issue read/write traffic, using the token you provided for that connection.

What never leaves

• Your repository, beyond what a given ticket's run actually reads or writes.
• The state database, audit log, runlogs and run artifacts.
• Secrets, your license token, and the real value of your model-provider key. See Agent isolation and secrets.
• Cost and usage figures, beyond the small metadata set in the license heartbeat. See What the license heartbeat sends.