Data processing terms

For account and billing data, Codexa is a controller. For data you store in projects, databases you connect, and applications you deploy, you are the controller and Codexa is a processor acting on your instructions through the product.

We process customer data only to provide the service: storing files, running sandboxes, building and serving deployments, and forwarding prompts to the AI provider you or your operator configured. We do not use your project data to train models.

The current list, with the condition under which each is used, is on the subprocessors page. We will update that page before adding a subprocessor.

Described on the security page: sandbox isolation, encryption of secrets at rest, hashed session tokens, server-side authorization, rate limiting, and audit logs.

You can export projects to GitHub and delete projects, workspaces, and your account from the product. Retention after deletion is described on the data retention page.

Team and Enterprise customers can request a signed agreement through contact sales or privacy@codexa.app.