Your code never leaves your cloud.

NittiM Enterprise runs the entire audit inside your own AWS account. Not a data-processing agreement about where your code goes — an architecture in which it has nowhere else to go.

In your VPC

Your code stays put

A component you operate fetches the repository — including GitHub Enterprise inside your network — and runs the deterministic evidence layer. You get its full source, and it verifiably contains no audit logic.

Sealed, in your account

The analysis happens in-house

NittiM's audit engine runs as a sealed service deployed inside your account. It receives only the prepared audit input, returns the finished report, and persists nothing. Confidential-computing attestation is the roadmap; the sealed image is today.

Your model bill

Claude, via Bedrock, in your account

The model call happens through AWS Bedrock in your own account and region. NittiM never proxies your code to anyone — and you pay AWS directly for model usage, at cost.

What NittiM never sees

Your code. Your findings. Your reports. Even the fact that a particular audit ran. Billing reconciles from signed usage receipts your side exports — counts and salted hashes, never repository names — so the license can be metered without a single byte of telemetry leaving your account on its own. The other direction is protected the same way: the audit engine is the licensed asset, sealed by packaging and license rather than by promise. The boundary contract in the evaluation kit spells out exactly what crosses it — in both directions.

The management plane is already here

Enterprise deployments plug into the same organization layer the hosted product runs on: SSO, per-organization isolation, an append-only audit log of every action, and policy-as-code via a .fis.yml your repos carry — so the verdict gate in CI enforces your policy, not just ours.

Evaluate it properly

The evaluation kit contains the full source of the component that touches your code, the complete boundary contract, the deployment topology, and the architecture brief — everything your platform and security teams need to judge the design before a single conversation.

Downloads are tied to your account, and we follow up personally — that's the whole funnel. Currently in the design-partner phase: annual license, scoped per organization.

Wondering how accurate the audits are? The benchmark — corpus, method, and every caveat — is public: see the numbers.