Security at
Alloyqa

Alloyqa stores the information needed to operate your workspace, including Tasks, Projects, Ideas, reviews, feedback, activity, repository and pull-request metadata, execution results, and workspace membership.

Workspace data is isolated by workspace. Access to Tasks, Projects, Ideas, reviews, repositories, members, and related data is checked against your current workspace membership and permissions.

Uploaded files and attachments are stored privately and are only made available through authorized, time-limited access.

Selected stored credentials are encrypted at the application layer. Task execution uses Alloyqa-managed worker and model-provider credentials.

Apple signing certificates and signing credentials are not required to be uploaded to Alloyqa for local iOS or macOS previews.

Tasks run through the Alloyqa agent and Cloud execution in isolated, job-scoped environments. Execution infrastructure is cleaned up after the work is finished, with safeguards for incomplete cleanup.

Cloud task execution is separate from local app previews. Preview builds run locally on the user's Mac rather than inside the Alloyqa task environment.

Alloyqa performs agent execution in the cloud, while supported macOS and iOS previews are run locally on your Mac.

For iOS and macOS changes, Alloyqa builds and runs the preview locally using Xcode.

Local Web Preview is not currently available in the user-facing product.

This keeps preview execution separate from Alloyqa's cloud task environment. Apple signing credentials do not need to be uploaded to Alloyqa in order to build and preview iOS or macOS changes locally.

Credentials required by the application itself remain subject to the project's own local configuration. Alloyqa does not automatically turn production credentials into preview credentials.

For connected repositories, Alloyqa connects through a GitHub App installation. The installation controls which repositories are available, and Alloyqa only lists those repositories for workspace and Task selection.

For connected-repository Tasks, Task credentials request Contents and Pull requests access to read code, create branches, push changes, and open pull requests. Commit statuses, Issues, and Checks are requested read-only to inspect pull-request conversation and verification results. GitHub metadata read access is required by GitHub.

The agent/task permission profile includes Workflows: write because a Task may modify GitHub Actions files under .github/workflows/**. Tasks that do not touch those files do not use that permission. Alloyqa does not deploy directly to production and uses short-lived installation credentials for repository operations.

A Task may instead use a public GitHub repository URL without connecting GitHub. Alloyqa validates the URL, retrieves the source anonymously over HTTPS, and runs the work in an isolated Cloud workspace. Public-repository Tasks receive no GitHub write credentials and cannot push changes or create pull requests.

How GitHub access works →

You can disconnect GitHub from Alloyqa Settings or revoke the App installation through GitHub.

When execution requires model assistance, relevant Task or code context may be sent to the configured model provider. The provider used depends on the configured execution path.

Public macOS releases use Developer ID signing, the hardened runtime, notarization, and stapling.

Normal app execution does not require root or administrator privileges.

Selected execution and preview logs use automated secret redaction before they are retained or transmitted. Redaction is not universal, and no automated system can detect every possible secret format.

Security questions, security concerns, and responsible-disclosure reports can be sent to privacy@alloyqa.com.