Trust should come with details.

Human Review access and evidence

Human Review operators can access only requests customers explicitly submit to that service. An operator role does not grant general browsing of customer repositories or access to their provider tokens. Assignment, scope agreement, messages and assessments are recorded against the request; a human assessment identifies its author, publication time and reviewed revision.

Withdrawing consent removes the copied evidence, ends operator access to the request and blocks pending notifications. It does not recall email already submitted to a sending provider. The request, messages, activity and earlier assessments remain in account records until account deletion. The privacy notice explains the limits of deletion and provider retention.

Controls implemented in the website

Available sign-in methods are shown on the sign-in page. The Cloudflare-owned sign-in path does not merge AntiCode accounts by email or profile. Where an additional method is enabled, you can explicitly connect an unbound CodHub or Cloudburg identity to your current account. An identity already connected to another AntiCode account cannot be moved or merged here. Cloudburg sign-in grants identity access only. Repository access requires separate read-only CodHub authorization, including private repositories you may access. Repository authorization must match your linked CodHub identity. Repository tokens are encrypted on the server and are never returned by dashboard APIs.

CodHub supports read-only repository discovery and bounded pull-request sync. Built-in checks are available only for SHA-1 repositories when CodHub supplies a complete diff with matching file, addition and deletion counts. Missing counts, incomplete diffs and SHA-256 reviews are rejected without replacing previous findings.

Eligible saved CodHub grants can renew automatically. Revoked access, legacy connections without a saved refresh grant, or uncertain renewal can require reconnecting in Setup. Disconnecting removes AntiCode workspace access; it does not revoke consent at CodHub or erase all stored history.

Controls that are not claimed

There is no published SOC 2 or ISO 27001 certification for AntiCode, no independent penetration-test attestation, and no uptime SLA. Vendor certifications do not become AntiCode certifications.

CodHub AI reviews, automatic reviews, comment delivery, CI ingestion, coding proposals and repository scans are not enabled in this release. Historical GitHub workflows do not establish those capabilities for CodHub. AntiCode does not execute repository code, approve or merge pull requests. Organization SSO, SCIM, custom residency, contractual SLAs and compliance certifications are not offered as verified capabilities.

Sensitive reports and procurement

Do not post secrets, personal information, or exploit details in a public GitHub issue. Review the vulnerability disclosure page for the current reporting-channel status.

The operator is Rashad Elkersawy in Oldenburg, Germany; contact admin@rtwochain.com. A customer DPA, verified retention schedule, and transfer details still need finalization for a complete procurement package.