DistilCode runs on the developer’s machine and talks to the model provider you choose, with your key. Your code does not go through us — with the few optional exceptions listed below, each of which an organization can switch off.
Every network flow
| Flow | Contains | Goes to | In BYOK mode |
|---|---|---|---|
| Model inference | Prompts and code | Straight to your own model provider, with your key | Always direct |
| Free mode | Prompts and code | DistilCode free proxy, then a free-model provider. Not stored. | Disabled |
| SmartCompact gate | Up to 16,000 chars of agent state | DistilCode API → typesafe AI (Jev). Not stored. | Disabled, or direct with your typesafe key |
| AutoJev | First 4,000 chars of the prompt | DistilCode API → typesafe AI (Jev). Not stored. | Disabled, or direct with your typesafe key |
| Usage metrics | No — token counts, cost, model, duration | DistilCode metrics store | Still sent (metadata only) |
| Sign-in and entitlement | No — account and plan | DistilCode API | Still sent |
Bring-your-own-key mode
Set DISTILCODE_BYOK=1, or have your organization admin turn on Require bring-your-own-key. The CLI then never sends prompts, code or agent state to DistilCode: free mode won’t start, and SmartCompact and AutoJev either call typesafe AI directly with your own key or fall back to local behaviour. Only sign-in and usage metadata are still sent.
Usage metrics
After each session the CLI reports token counts, cost, model, duration and tokens saved. It never includes prompts, code, file names or tool output. Organization dashboards show only sessions a developer ran while a member, signed by their own entitlement — never personal or earlier sessions — and an admin can turn attribution off entirely.
Licensing you can verify
Seats and policies reach the CLI as a short-lived Ed25519-signed entitlement, checked offline against keys built into the binary. It refreshes daily and keeps working for 7 days without a connection, so a network outage doesn’t lock developers out — and editing local files can’t change a plan or switch a policy off.
Accounts and organizations
- Roles: owner, admin, billing and member, with an audit log of membership, seat, policy and billing changes.
- Verified domains: prove ownership with a DNS TXT record and colleagues with verified work emails join automatically.
- Invites expire after 7 days and only work for the invited email address.
- Passwords and session tokens are stored hashed.
Sub-processors
- Vercel — website and API hosting, AI Gateway relay
- Neon — account and organization database
- Cloudflare — free-model proxy and usage metrics
- typesafe AI — Jev model for SmartCompact and AutoJev
- Dodo Payments — payments and invoices
- Microsoft Clarity — website analytics only
Questions
Security reviews, DPAs and questionnaires: [email protected]. See also the privacy policy.