Skip to main content
This page answers the common questions in a line or two and points to where the full answer lives:
  • Privacy Policy: what we collect, how long we keep it, and your privacy rights.
  • Terms of Service: ownership, acceptable use, and responsibility for what agents do.
  • Trust center: security controls, policies, compliance reports and our subprocessors.
The Privacy Policy and the Terms are binding. Where this page differs, they win.

​
Your data

​
Who owns my code and content?

You do. Reason claims no ownership of it (Intellectual Property in the Terms).

​
Do you train AI models on my code?

No. Reason does not train AI models on your code, prompts or Sessions, and the model providers we use do not train on it either.

​
Where does my data go?

Reason stores what a Session needs to run and resume. Each turn sends the context it needs to the model you picked. Commands run on the computer the Session uses, and connected services see only what the agent does in them. For the list of subprocessors, see the Trust center.

​
How long do you keep it, and how do I delete it?

Until you delete it, apart from a few records that expire on their own (Retention in the Privacy Policy). Delete your account in account settings, or on the account deletion page if you cannot sign in.

​
Who can see it

​
Who in my Workspace can see my Sessions?

Sessions of your main Reason are yours alone. A shared Reason’s Sessions are visible to the people it is shared with. See Workspaces and sharing.

​
Can Reason staff see my data?

No one at Reason can sign in as you or open your Workspace. For support inside your Workspace, invite our support address as a member yourself. The narrow, logged exceptions are listed under Local and Cloud Processing in the Privacy Policy.

​
How are my secrets protected?

They are encrypted, never shown again after you save them, and decrypted only for the run that uses them. See The Vault. Put secrets in the Vault, never in chat.

​
How Reason is protected

​
How are cloud computers isolated?

Each cloud computer is its own virtual machine in one Workspace, and its outbound traffic goes through an allowlist (network policies).

​
What can Reason do on my own computer?

Work only in the folders you grant, with your user permissions (Computers).

​
What can the agent do in my connected services?

Only what both the permission you granted and your instruction allow. Disconnecting stops future access but does not undo past actions (Connected Services in the Terms).

​
How do API keys work?

Each key belongs to one Workspace and carries only the scopes chosen when it was made (Authentication and scopes).

​
Compliance and contact

​
Do you offer SOC 2, HIPAA and zero data retention?

Yes, on Enterprise: SOC 2, HIPAA, zero data retention with model providers, and our compliance certificates and reports. To set it up, email contact@reasonmachines.com or talk to us in your shared Slack channel.

​
How do I reach you?

Email contact@reasonmachines.com. Every paying workspace also gets a Slack invite to a shared channel with our team, sent automatically.

​
Subprocessors, DPA or a security questionnaire?

Go to the Trust center. For anything it does not cover, email contact@reasonmachines.com.

​
How do I report a vulnerability?

Email contact@reasonmachines.com with steps to reproduce, and leave out real secrets (security.txt).