Docs menu
⌘K

Help

Security & data

Midas is built on zero data retention: your code and prompts are not used for training. The service still keeps the records it needs to run the account, meter usage, show session history, and bill a workspace.

Training

Your code and prompts are not used to train a model. Midas is an orchestration layer around models, not a model of its own. No model in the product is trained on your code.

What the service stores

  • Account, workspace, wallet, card, invoice, and usage records.
  • For a session, the metadata the dashboard needs: timestamps, model, token counts, cost, the files the session read, and a short prompt excerpt.
  • For a review, the pull request, commit, confidence, findings, and the customer and upstream cost.
  • For a cloud sandbox, the repository, base branch, pull request number and URL, status, timing, and a bounded failure reason.
A sandbox record does not contain your repository contents, the diff, or the transcript. A review record contains findings, which are also posted to GitHub. A session transcript is local to the CLI.

Cloud sandboxes

  • The repository is cloned with a short-lived, repository-scoped GitHub App token.
  • Model access uses a short-lived token bound to that one sandbox.
  • The workspace is an emptyDir volume with no persistent disk, and it is destroyed with the pod.
  • There is no inbound network route and no service account token mounted into the pod.
  • The sandbox token and the GitHub token are revoked or deleted at teardown.

The sandbox keeps identifiers, not code. The dashboard links to the draft pull request; it does not store the changed files.

Access tokens

  • A CLI login mints a durable token stored on your machine and shown once in the dashboard.
  • A sandbox token is scoped to one sandbox and cannot act as a human account.
  • A GitHub installation token is scoped to the repositories the app may read.
  • Remote control connects outbound to the Midas API. Nothing listens for inbound connections.

Your control

  • Revoke a CLI token from the dashboard at any time.
  • Turn remote control off with midas relay stop.
  • Turn cloud sandboxes off for a workspace in Settings.
  • Unlink a GitHub installation from the workspace.
  • Delete a session with midas session delete.

Questions

Ask at hello@trymidas.io. The FAQ covers the short answers, and Cloud sandboxes has the full run lifecycle.