Transparency

Third-Party Disclosures

This page lists every external service the Cromus GitHub App contacts, what data is shared with each service, and why. It is kept up to date whenever the app's external dependencies change.

Last updated: August 2026

Skill content never leaves Cromus

SKILL.md, ETHOS.md, MEMORY.md, GRAPH.md, and any other file content you submit through the GitHub Copilot Extension is processed entirely in memory on Cromus servers. It is not forwarded to any third-party AI provider, analytics service, or data broker, and it is not stored after the response is returned.

Services the Cromus GitHub App contacts

GitHub

Authentication and request integrity

Privacy policy

Data shared

Copilot request signature (ECDSA public-key fetch) and Bearer token (identity verification). No skill file content is sent to GitHub.

GET api.github.com/meta/public_keys/copilot_api

Fetches the ECDSA P-256 public key used to verify that inbound Copilot Extension requests were genuinely signed by GitHub. The key is cached for 10 minutes; no user data is sent in this call.

GET api.github.com/user

Validates a Bearer token on the fallback authentication path. The token is passed in the Authorization header; the response confirms the token's owner identity. Used only when the primary ECDSA signature path is unavailable.

Services the Cromus GitHub App does not contact

The following services are used by other parts of the Cromus platform (web app, dashboard, payments) but are not called by the GitHub Copilot Extension. Skill content is never sent to them.

  • OpenAI
  • Anthropic
  • Google
  • Stripe
  • Any analytics or telemetry provider
  • Any AI inference provider

Changes to this page

If a new third-party dependency is added to the Cromus GitHub App, this page will be updated before the change reaches production. Significant changes will also be noted in the app's changelog.

Questions about data handling can be sent to contact@cromus.ai. See also the full Privacy Policy.

© 2026 Cromus AI, Inc.