For security review
Where your data lives, and what leaves it.
Two questions decide whether a tool is allowed near an application you cannot hand to a stranger: which machine holds the results, and which outside services see anything on the way. This page answers both.
What runs where
There are two ways to run this, and the difference between them is who ends up holding the runs, the captures and the findings.
Your own infrastructure
The harness server, its database and the model keys are yours, and the runs, captures and findings stay on your machines. It is one deployment to run and keep patched, and it is the only option where no one else holds the results at rest.
The instance run for early access
A server is running at https://qa.dust.observer, paired with the tracker at https://app.dust.observer. If you point the app at it, the runs, captures and findings are stored on that server and are readable by whoever operates it. It is the fastest way to see the loop work, and it is not the way to keep a confidential application to yourself.
What leaves the instance
Three services ever see anything a run produces, and each of them has one job. The table below is the whole list of services outside the deployment, and none of the three is called for any purpose other than the one named against it.
A judged call is narrow by construction. It carries the state its questions read and not the rest of the session behind it, so a decision about one page does not travel with everything the run has touched.
| Service | Job | What it receives |
|---|---|---|
| DeepSeek | The agent’s language model | Every inference the agent makes: planning a run, reading a page, writing up a finding. The calls are made by the harness with the harness’s key. Dust calls no model provider at all — its QA chat passes the question to the harness, so the call is the harness’s. |
| TypeSafe System One (Jev) | Typed decisions, for both products | The harness asks it to score a run, extract acceptance criteria, classify an HTTP failure or a console line, look up an element, and order the review queue. Dust asks it to rescue a severity word, cross-check a would-be all-clear verdict, and keep a polish edit from dropping a fact. Each call carries only the state its questions read, and each is fail-open: an answer that never arrives costs a judgment, never a result. |
| OpenAI | Text embeddings, for the harness’s memory only | Text the agent has chosen to remember, turned into vectors so it can find what it already learned. It is not used for inference, and the key lives on the server — the command line never sees it. |
What is stored, and what is audited
Conversations with the agent are stored on the instance, with their transcripts, so a run can be read back later.
Deleting a conversation is itself an audited action: the deletion is recorded rather than the conversation going quietly missing.
Anything the agent files or changes lands on the issue it touched, and that issue’s event log is append-only, so a transition, a verification or a finding is an entry that stays.
The distinction is worth stating plainly, because the loose version of it would be false: the audit trail is the issue’s log and the recorded actions on it, not every line typed into a chat. A question asked in conversation is conversation.
The agent answers with the asker’s own permissions
A question put to the agent about an issue is answered with the asker’s own read-only token, narrowed to a single workspace. The agent can never show more than the person asking can already see, and a question cannot be used to reach into a project the asker has no part in.
The same narrowing covers the credential itself: a token minted for one workspace is confined to it and expires, so it is not a permanent key to the tracker.
Observer
What happens when a judgment is unavailable
The judgment layer is fail-open. Judges run against a key the operator supplies, and when a judgment does not arrive — no key configured, a service outage, a call that times out — the judges report themselves unscored and the run carries on.
A criterion that would have been judged falls back to a deterministic scan rather than being recorded as verified, and nothing is held while a service is down. An outage costs a judgment. It does not cost a result, and it does not stop a write.
This site
The page you are reading is part of the claim, so it is held to the same standard as the products it describes.
- No cookies, and no preference stored by the site at all — the light or dark appearance follows your operating system’s setting.
- No analytics, no tags and no third-party scripts.
- No form: there is nothing to submit, and no processor behind it to receive what you type.
- The typeface is fetched when the site is built and served from this origin, so reading the site makes no request to anyone else.
The model
The agent runs on DeepSeek.