How Tamda handles your code

Tamda never generates line-numbered diffs. Every code change is an exact, verbatim string replacement: if the text it's trying to replace doesn't match your file byte-for-byte, it refuses to apply the edit and aborts, rather than guessing at the closest match. A guess that lands in the wrong place is exactly the failure mode that would break trust in this product, so the system is built to fail loudly instead.

Nothing ships without a human. Every change becomes a normal pull request on your repo, reviewed the same way any other PR would be. An experiment can't be marked as running until Tamda has independently confirmed, by checking with GitHub directly, that its PR was actually merged, not just opened.

Each workspace connects its own repo with its own credentials. We recommend a fine-grained personal access token limited to that one repo, not a classic token with account-wide access, and we check that the token and repo actually work the moment you save your settings, instead of only finding out when a real PR fails.

Every prompt Tamda sends to the model, and every response it gets back, including failed and retried attempts, is stored per workspace and viewable in Settings. You can see exactly what Tamda was told and exactly what it said back for any generation, not just the final result.

The endpoints your app calls to send Tamda event data are rate-limited per workspace, and AI generation is capped per workspace per day. Both exist so a bug or a runaway retry loop can't turn into either bad data or a surprise bill.

We're an early-stage, hosted-only product, not SOC2 certified, and this page isn't a compliance filing, it's an honest description of what's actually built right now. If you have specific security or compliance requirements before you'd connect a real repo, tell us what you need and we'll give you a straight answer about whether we can meet it yet.