We aim to collect as little as possible. Depending on how you use Mergent, that may include:
We use your information solely to operate the Service: to authenticate you, run analyses, generate reports, and improve reliability. We do not sell your data.
We don't keep your source code. Repositories are cloned or extracted into ephemeral, per-session workspaces, parsed for structured facts, and discarded after the analysis run completes.
The parsing step happens server-side. From it we derive a compact set of facts — service names, endpoints, dependency edges, table names, configuration values — which is what powers the rest of the pipeline.
Mergent uses a large language model (Google Gemini by default) for the reasoning steps of its agents. By design, only the extracted facts — never raw repository dumps — are sent to the model provider.
Model providers process this data under their own terms. We send the minimum necessary to produce your analysis.
You may request access to, correction of, or deletion of your personal data at any time. To do so, contact us and we'll respond within a reasonable period.
We transmit data over encrypted connections and store secrets such as API keys only in environment variables — never in code or repositories. No system is perfectly secure, but we follow sensible engineering practice to protect your data.
We may update this policy. Material changes will be reflected in the “Last updated” date above.
Privacy questions? Reach us at hello@mergent.dev.