HARNESS · PRIVACY · UPDATED ON
What Harness keeps about you, and why.
This page describes what the Cloud IDE and the Harness console handle today, according to the code that is live. It applies together with Reveno's privacy policy.
Controller: Intimidade Pública e Consultoria Ltda. (Reveno brand), CNPJ 58.407.161/0001-84. Contact for any request about your data: contact@thiagoholtz.com. This text is being reviewed by a data protection specialist.
Data the Cloud IDE keeps
- Account. Email, name and the password transformed with scrypt (the password itself is not stored). Used for invitation sign-in.
- Access session. An HttpOnly cookie for this site only, valid for up to 12 hours. No analytics or advertising cookies.
- Workspace usage log. Date and type of each event: invitation accepted, sign-in, terminal opened or closed, workspace on or off, session opened, merge into main. Used to run and audit the service.
- Agent receipts. For each tool Claude Code uses: the tool, the policy decision, a short summary of the command with secrets masked, the input hash and where the action happened (project, branch and folder). The full input goes through the server so the policy can decide and is not stored; only its hash remains. Receipts are insert-only, because they are the proof of what happened.
- Approval requests. While they wait for your decision, they keep a preview of up to 800 characters of the action. The preview is deleted when you decide or when the request expires.
- Your files. What you create or clone stays in your workspace volume. Reveno uses those files for nothing beyond keeping the workspace running.
What does not go through Reveno
- Conversations with the AI model. Claude Code and Codex run with your own account. What you send to Anthropic or OpenAI follows your contract with them.
- Third party credentials. Sign-ins such as GitHub stay in your workspace home. Reveno does not ask for or copy those tokens.
Where and for how long
- Where. On a server rented by Reveno, isolated per workspace (gVisor, no privileges, its own network).
- Copies. The IDE database (account, events, requests and receipts) is copied daily on the same server, and the last 14 copies are kept.
- Web server access logs. IP address, browser and requested page, kept for a few days for security.
- Account and files. Kept while early access is active. At the end, or at your request, the workspace and the account are removed; receipts already issued are handled as the specialist advises, because they serve as proof.
Your requests
To learn which data exists about you, correct it, export it or request deletion, write to contact@thiagoholtz.com. You can download your agent receipts at any time from the Receipts panel in the IDE.
Not yet a place for client data or third party personal data: the external security review comes first. See the limits on the Trust page.