Production data stays in the customer boundary.
The hosted control plane holds organizations, policy, aggregated reports, and plan limits. Raw snapshots, secrets, and captured request bodies stay in your cloud by default.
Two planes. Evidence can leave. Records of production should not.
| Control plane | Organization metadata, account names and emails, GitHub identifiers, session records including IP address and browser user agent, policy configuration, aggregated reports, historical comparisons, audit entries, and the plan that sets an organization's limits. |
|---|---|
| Your boundary | Raw snapshots, secrets, captured request bodies until redacted, raw logs and traces, sanitization, provisioning, egress enforcement, and cleanup. |
| Careers applications | Name, email, selected role, an optional work link, your introduction, and acknowledgment of the current compensation. These are stored separately for recruitment review by an authorized operator, not added to customer analytics or a mailing list. No applicant IP address or browser user agent is stored in the application record. Applications expire through scheduled maintenance after 180 days, or an operator can delete them sooner. Backups expire separately. Contact us privately to request removal and include your application reference. |
| This site | Contact and demo forms store the details you submit, the source page, and the submission time in the control plane database. Public requests cannot read stored leads. Website measurement is described separately below. |
Sanitization happens where the data already lives.
| Customer-hosted data plane | Masking, subsetting, and credential deletion execute inside your cloud. |
|---|---|
| Outbound-only agent | Communication leaves the customer agent where possible, with short-lived credentials. |
| No snapshots in the host | The hosted control plane is not a backup target for production-derived state. |
Payments are handled by Stripe.
Checkout and the billing portal are hosted by Stripe. Card details entered there are sent directly to Stripe.
Stripe billing is enabled for a deployment when AF_STRIPE_SECRET_KEY and AF_STRIPE_WEBHOOK_SECRET are configured. Stripe then processes payments and stores customer, subscription, and invoice records for that deployment. Billing is unavailable when Stripe is not configured.
Website analytics and your privacy controls.
Website measurement uses an internal page counter and PostHog for interaction analytics and session replay. PostHog’s recorder loads through our endpoint. The contact page also loads a Cal.com booking widget, which uses its own Sentry error reporting.
Five things leave your browser for the counter: a page shape from a closed list, a channel from a closed list, a random identifier for one browsing session, a timestamp, and a campaign tag when you followed a link carrying one. The referrer and the URL are turned into those bounded values in your browser, so the address you came from is never put on the network at all.
PostHog sees more, and this is the whole of it: the address and title of the page you are on including its query string, the page you arrived from, each route you move to, how far down each one you got before leaving it, the clicks and form submissions you make along with the tag, classes and visible label of what you clicked, your browser, operating system, device type, screen and window size, browser language and timezone, and a recording of the pages you visit. A recording holds their structure and styling, your cursor, your clicks and your scrolling. Not your raw browser identification string, which is stripped before anything is sent, and not your address.
Typed form values are masked in session recordings before those recordings leave your browser. A recording shows masked fields rather than the values you entered. Submitting a form separately sends the details needed to process that request.
Neither analytics system sets cookies. Their identifiers are scoped to the current browser tab.
PostHog, Inc. receives and processes this website analytics data in the United States through PostHog Cloud US. Requests go through our endpoint at app.antifailure.dev, which forwards the analytics to PostHog without forwarding your IP address.
One claim is unaffected and it is a different claim: your production data never leaves your own boundary. That is about the engine and the runner, neither of which has an analytics client to leave with. This section is about a website you are reading.
Global Privacy Control and Do Not Track are honoured by both, without asking. The switch below is for everybody else, and it takes effect on the page you are reading rather than on the next one: anything captured and not yet sent is thrown away with it, and the recording ends. If you arrive with any of those already set, PostHog’s code is never fetched at all, so there is no recorder that read this page before something told it not to.
Reading this browser.
Checking this browser's privacy settings.
Signing in creates a session record and grants membership of the organization the GitHub App was installed on. That record, the organization and its policy are what the control plane keeps. Everything this notice calls production data stays in your cloud.
Bring your next pull request.
See how Antifailure would test your stack, what it would check, and the evidence your team would review before merging.