Legal
Privacy Policy
Effective date: August 20, 2026
This policy explains what Legwork processes, why it needs it, and how long it keeps it. Legwork is an automated incident investigation service: it reads the code you connect and the incident data you send, and returns a diagnosis with citations.
1. What we process
- Account data. Your email address and organization membership, handled through WorkOS. Legwork does not store passwords.
- Repository contents. When an analysis runs, the source of your connected repositories is downloaded at the exact commit involved into a disposable sandbox, read, and destroyed with that sandbox. Access is read-only.
- Incident data. The payloads you send to the ingest endpoint or through a connected alerting provider: titles, severities, timestamps, and any context you include.
- Analysis output. The diagnosis, its evidence citations, and the step-by-step record of the investigation.
- Operational records. Audit events for administrative actions, delivery records for notifications and callbacks, and usage counters for quota enforcement and billing.
2. Why we process it
To provide the service you asked for: to investigate the incidents you send, to deliver the results to the destinations you configure, to enforce the quotas on your plan, and to keep the service secure and available. Legwork does not sell your data, does not share it for advertising, and does not use your source code or incident data to train models.
3. How long we keep it
Incidents, analysis runs, diagnoses, investigation steps, and delivery records are retained for 30 days and then deleted automatically by a daily purge. Repository source is never retained past the run that read it: the sandbox holding it is destroyed when the analysis ends. Account, organization, and billing records are kept while your account is open.
4. Secret redaction
Incident payloads are scanned for credentials and redacted before analysis, and the summary and root cause are redacted again before they leave the system to a notification channel or callback. Redaction is pattern-based and cannot be guaranteed to catch every secret, so avoid sending credentials to the ingest endpoint.
5. Subprocessors
Legwork relies on the following providers to run the service:
| Provider | Purpose |
|---|---|
| Railway | Application hosting and disposable analysis sandboxes |
| WorkOS | Authentication and organization membership |
| OpenRouter | Model inference for incident analysis |
| GitHub | Read-only repository access for connected repositories |
| Dodo Payments | Billing and payment processing for paid plans |
| Resend | Email delivery for notification channels |
6. Security
Stored credentials — provider tokens, webhook destinations, and callback secrets — are encrypted with AES-256-GCM bound to the record they belong to. Repository code is read in a sandbox with no network egress, and command execution is disabled unless an operator has verified an isolation probe. Outbound callbacks resolve to public addresses only, with the resolved address pinned for the request. The security page describes the model in full.
7. Your choices
You control which repositories are connected and can disconnect them at any time, which ends Legwork's access. You can delete services, notification channels, and API keys from the dashboard. To request deletion of your organization's data, or a copy of it, write to hello@legwork.cloud. Deleting your organization removes its incidents, analyses, and diagnoses.
8. Changes and contact
If this policy changes materially, the effective date above changes and account administrators are notified. Questions about this policy, or about how your data is handled, go to hello@legwork.cloud.