Security

Pretense sits between your AI coding tool and the model it talks to. Before the request leaves your machine, secrets and personal data are swapped for stand-ins and code identifiers are renamed. When the answer comes in, the identifiers are restored. The secret stand-ins stay as they are. This page describes that guarantee precisely, including where it stops.

The guarantee: mutation, not deletion

Pretense never one-way redacts, and it never passes a detected secret through untouched. At egress, every detected value is replaced with a stand-in, so the provider never sees the original and the model still gets a coherent, well-formed request. The way back is deliberately one-sided. Renamed identifiers are restored byte-exactly, and anything less is a bug. Identifiers are code names, not credentials. Secret and personal data stand-ins are never put back into the reply. A model can echo a stand-in inside a link or an image address, and swapping the real value in there would hand it to whoever controls that address. Your tooling sees the stand-in where the secret was, and the secret itself never left your machine.

Every request takes the same path

The proxy mutates each request on the way out and restores the renamed identifiers in the reply, so this happens on every call rather than on a path you have to remember to opt into. The audit log records what was swapped, request by request, so you can confirm the outbound side rather than take it on trust. See how it works for the mechanism in detail.

What stays on your machine

Detection, mutation and reversal all run locally. The mapping that lets a stand-in be turned back into the original value stays on your machine — it is not uploaded, and without it the stand-ins are inert. Scanning a file and reversing a mutation are local operations and are not metered.

Air-gapped mode

On the Enterprise plan, Pretense can run against a model on a runner you control, over loopback, so your prompts and code never leave the machine at all. Air-gap fails closed: without a valid licence every request is refused rather than quietly falling back to a hosted provider. That refusal is correct behaviour, not a fault.

Being explicit about the limit, because it is the kind of detail that matters in a review: air-gapped means your prompts and code stay local. It does not mean the CLI never opens a socket. Installing it uses the network, signing in uses the network, and usage counts are reported unless you turn them off — including for a request that was refused. Setting PRETENSE_USAGE_REPORT=off stops that, and a machine with no route out at all can import its licence instead of fetching it. The full procedure is in the air-gap guide.

Audit trail and compliance presets

Pretense ships policy presets for HIPAA, GDPR, SOC 2, NIST and PCI. A preset re-weights how severely findings are scored for that framework so the audit trail reflects the standard you are working to. To be unambiguous about what that is and is not: a preset is a scoring profile and an audit trail. It is not a certification, and using one does not make a deployment compliant on its own.

Certification status

Audit trails and policy presets are available today. No auditor has been engaged and no SOC 2 report or HIPAA certification has been issued. We would rather say that plainly here than let a badge on a marketing page imply an attestation that has not been issued. If your procurement process needs the current status in writing, ask and we will send it.

Reporting a vulnerability

Email [email protected] with steps to reproduce and anything needed to assess impact. This is the same address the customer agreement names for reporting unauthorized account use or a security incident. Give us a reasonable window to ship a fix before disclosing publicly, and please do not run testing that degrades service for other customers or touches data that is not yours.

For anything else — a security questionnaire, an architecture review, or a question this page did not answer — get in touch.