AI, your code, and model providers

Aulay runs AI agents against your source code. That deserves a plain answer to one question: where does your code go? This page is that answer. It is not a legal formality — it describes the actual data path.

1. Aulay does not call an AI model

There is no Anthropic, OpenAI, Google or other model API call anywhere in Aulay’s servers. We are not a reseller, a proxy, or a router for model access, and we do not hold a model provider account on your behalf.

Agent work is performed by command-line tools that run on your machine, signed in with your provider account. Aulay starts them, keeps them alive, and shows you what they are doing.

2. Which tools, and which provider each one reaches

Each of these is governed by that provider’s own terms, privacy policy and data retention practices. If you care whether your code is retained or used for training, that is a question for the provider you signed in with — including whether your account is on a consumer or business plan, which for several providers changes the answer.

3. The exception: Cursor Cloud Agents

Cursor Cloud Agents work differently and you should understand the difference before enabling them. When you start one, Aulay sends the repository URL, the branch, and your Cursor API key to Cursor. Cursor then clones your repository into Cursor’s own cloud infrastructure, works on it there, and can open pull requests against it. The feature requires a GitHub remote, so GitHub is also in that path.

On this path your source code is processed by Cursor and GitHub rather than running on your machine. If that is not acceptable to you, do not use this feature.

4. What Aulay itself stores

We would be misleading you if we let “we never call a model” imply “we never see your content”. We do see and store some of it.

• Session transcripts. The prompts you send and the output the agent returns are relayed through Aulay’s control plane and stored in our database, so that a session survives a closed laptop and can be resumed on another device. That is the product.
• Invocation records. The same content is recorded as structured input and output on the invocation that produced it.
• Session metadata. Titles, summaries, which project and branch, which machine, and the busy/idle/needs-input timeline.

What we do not store: your repository. Aulay holds no clone, no bare mirror, and no working tree of your code. Checkouts and worktrees live on your own disk. The only source code that reaches our database is whatever appears inside a transcript because an agent quoted it there.

5. We do not train on any of it

Aulay operates no model training or fine-tuning of any kind, and does not make your content available to anyone else for that purpose. There is no pipeline that could do it.

6. Practical advice

• Treat everything an agent can read as disclosed to your model provider. Do not point one at a repository containing secrets you have not rotated.
• Check your provider’s retention and training settings. Several providers treat business and consumer accounts differently.
• Review agent output before merging it. Agents are not deterministic and will sometimes be confidently wrong.
• Transcripts are retained on the schedule at Data Retention, and are deleted when you delete your account.

7. Questions

If something here is unclear or you think it is inaccurate, write to privacy@aulay.io. We would rather correct this page than have you guess.