Security

Local-first by design

RaptorCode runs entirely on your machine. Your model API key is stored locally with restrictive file permissions and reused across sessions — it is never transmitted to RaptorLabs. Your source code stays on your machine; the only data that leaves is what you send to your chosen model provider as part of a request.

Sandboxed, gated execution

Autonomous work is contained and kept under your control:

• Isolated worktrees. Every agent is sandboxed to its own git worktree. Parallel work cannot collide, and nothing is committed without you.
• Explicit consent. Agentic mode requires per-session consent before any tool can touch your filesystem.
• Workspace-scoped writes. File writes are confined to your workspace by default; writing outside it requires explicit, per-session approval.
• Command guardrails. A policy layer blocks catastrophic shell operations outright and prompts for confirmation on higher-risk actions before they run.
• Human review gate. You always get a diff to review and decide what is merged.

Data handling & privacy

RaptorCode does not harvest your code or prompts for training or telemetry. Requests you make are sent to the model provider you configure, under that provider's terms. For details on the website's data practices — analytics, the early-access waitlist and the AI assistant — see our Privacy Policy.

Intellectual-property protection

RaptorCode is proprietary, closed-source software. The product includes layered protections for its own intellectual property, and its agents are designed to refuse attempts to disclose internal system instructions. These measures protect RaptorLabs' IP and do not weaken the security of your work.

Secure development practices

Our engineering process is designed around ISO 27001-style controls: change traceability, secure configuration, least privilege, dependency hygiene, and documented security assumptions. Releases are built from a clean, gated pipeline, and official binaries are published with SHA-256 checksums so you can verify integrity before installing.

RaptorLabs is not currently certified against SOC 2 or ISO 27001. We follow practices aligned with these frameworks and will pursue formal attestation as the product matures.

Verifying downloads

Every official build is distributed through raptorcode.dev with its SHA-256 checksum shown on the download page. Windows builds are currently unsigned and ship with checksum-verification and SmartScreen guidance; macOS builds are signed and notarized.

Responsible disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability, please email security@raptorlabs.dev with details and reproduction steps. Please give us a reasonable window to remediate before any public disclosure. We do not pursue legal action against researchers who act in good faith and avoid privacy violations, data destruction, and service disruption.