Where your data goes and who can access it

Five boundaries

The organisation is part of every request

Not a filter one can forget, but part of the record and of the request: in the hosted service, every access to the factory carries its organisation, and one organisation’s data simply does not exist for members of another.

On the Claude paths: no key, no run

On the Claude paths nothing runs without your organisation’s key: the service rejects the request with 401. For OpenAI-compatible providers, the organisation’s key acts as an override of a configured default.

Keys stored encrypted

In the hosted service this is enforced: without a configured storage key the service refuses to start, and credentials are stored encrypted instead of in plain text. Self-hosters must set this key — without it, credentials are stored unencrypted.

Building and testing without privileges

Where generated code is built and tested in the hosted service, it happens in an unprivileged, throwaway pod instead of the coordinator. Foreign code is executed there — which is exactly why it runs where it can reach nothing. Self-hosters have a legacy choice, "analyzer=gradle", that removes precisely this boundary: there the generated code runs inside the coordinator process.

Repository access stays with the coordinator

The worker never sees your repository token. It clones and pushes through an opaque in-cluster address; only there is the credential applied. What it carries is a short-lived pass the coordinator issues per run, scoped exactly to your organisation and project — a foreign or expired pass is rejected. The generated code cannot issue itself one: the seal is not in its hands. In the hosted service, startup additionally aborts if this seal is missing.

Why failing is the right default

The convenient construction is the opposite one: if a key is missing, take the shared one; if the organisation is missing, show everything. Both conveniences are invisible in normal operation and, in the failure case, are the damage itself.

Anvil Coder decides the other way at the points named above: on the Claude paths the service rejects a request without the organisation's key with 401, and in the hosted service no request reaches the factory without its organisation. That is more annoying during setup — you notice immediately when something is missing — and exactly therefore correct.

Where the data lives

Operations run on the Infomaniak Public Cloud in Switzerland. For teams that have to justify data sovereignty, that is not a side note but often the first question.

The models themselves naturally live with their providers. The connection is interchangeable and covers local models via Ollama — which provider runs is a deployment decision. Compute time can be priced; if a price is set, runtime flows into the cost accounting. Without it, local models run at cost zero.