AI & Code Processing Disclosure — ORA by Aurem CTO

Last updated: February 12, 2026 Effective: February 12, 2026

ORA by Aurem CTO reads your GitHub repository, generates fixes with large language models (LLMs), and commits code directly. This document explains — in engineering-grade detail — exactly what happens to your code when it enters our system.

This disclosure supplements our Privacy Policy, Subprocessor List, and Terms of Service.

1. What We Access

When you connect a GitHub repository:

We do not clone your entire repository to our servers. We fetch only the specific files an active task requires.

2. Where Your Code Goes (LLM Routing)

ORA uses a multi-model "Parliament" router. A single task may be evaluated by 2–3 models in parallel for consensus. The models currently in production:

Which model sees which code is deterministic per task type. See our Subprocessor List for full inventory.

2.1 Data Flow

Your Browser → Aurem CTO backend (Canada/US region) → LLM provider API
                                                    ↳ Response → Aurem CTO → GitHub commit

Every hop uses TLS 1.2+ encryption in transit.

3. Training & Model-Improvement Opt-Out

Your code is never used to train LLMs. We contractually enforce this in the following ways:

If any upstream provider changes their training policy, we will notify you 30 days before continuing to route traffic to them, and we will provide an opt-out.

4. Data Retention at LLM Providers

Even without training, some providers cache request/response pairs for abuse monitoring. We use the shortest retention available:

Aurem CTO's own retention: Selected file contents are purged from our servers within 24 hours of task completion. Only the diff, commit SHA, and task metadata are retained per §1.

5. What We Do NOT Do

• ❌ We do not sell your code or code-derived data.
• ❌ We do not use your code to train our own models (we don't train any models).
• ❌ We do not share your code with LLM providers for their own training.
• ❌ We do not access files outside the scope of an active task.
• ❌ We do not read repositories you have not explicitly connected.
• ❌ We do not persist your PAT in plaintext or in logs.

6. Sensitive-Data Detection

Before sending file contents to an LLM, we run a pre-flight secret scan using detect-secrets patterns to redact:

• API keys (AWS, Stripe, OpenAI, GitHub, etc.)
• Private keys (RSA, EC, PGP blocks)
• Database connection strings with credentials
• JWT tokens with recognisable structure

Redaction replaces the match with [REDACTED_SECRET_<type>] before the LLM sees it. This is best-effort — you remain responsible for what is committed to your repo.

7. Human Review

• Your code is not read by Aurem CTO staff except when you explicitly file a support ticket that requires it. Such reviews are logged, and you are notified.
• Anonymised/aggregated task metadata (model latency, error rates, no code content) is reviewed by engineering for reliability and cost optimisation.

8. Model Output Warranty

LLM output is probabilistic. Aurem CTO does not warrant that generated code is:

• Bug-free
• Optimal
• Free of licensing conflicts with third-party dependencies your project pulls in

You are the final reviewer. Every fix goes through a preview + commit step. We recommend keeping automated tests + code review in your workflow. See Terms §7 — Limitation of Liability.

9. Rights & Requests

Under GDPR, CCPA/CPRA, DPDP Act, and PIPEDA, you may:

• Request a copy of the AI-processed history on your account
• Request deletion of your task history
• Request the specific LLM provider that handled a given task ID
• Withdraw consent and terminate LLM processing (this ends your ability to use ORA fixes but preserves your account)

Email privacy@auremcto.com with your account email and task ID(s).

10. Changes

Material changes to LLM routing, subprocessor list, or retention windows trigger email notice at least 30 days before taking effect.

11. Contact

Polaris Built Inc Incorporated in Canada AI/data inquiries: privacy@auremcto.com Engineering security: security@auremcto.com