Version: 1.1 · Last updated: October 22, 2026
ThriveOnDev is the agent-neutral delivery control plane for Linear. This overview describes its isolated execution, explicit deployment boundaries, and the connected record kept for every run. The same overview is available as a PDF for procurement reviews.
Deployment paths
Use managed cloud for pilot activation, or install the whole platform in your Kubernetes environment when policy requires an in-perimeter control plane. Both paths share one operating model.
Managed cloud
Per-tenant Kubernetes namespaces with Pod Security enforcement, HMAC-signed callbacks, and an issue, graph, event, and outcome trail recorded by the pipeline — not self-reported by the agent.
Self-hosted via Helm
Control plane, planning, execution, and data stay in your cluster, with offline license validation, Keycloak SSO/OIDC, and an air-gapped installation path.
Execution and data boundary
Linear sends issue context to the control plane, which starts an isolated Kubernetes job that works with the repository:
- Linear: issue, comment, and status
- Control plane: graph, routing, and events
- Isolated Kubernetes job: agent, credentials, and tools
- Repository: code, checks, and pull request
The job filesystem is ephemeral. The control plane retains run records, not a repository copy. In self-hosted deployments, platform data stores, code, credentials, and jobs remain inside the customer boundary; model calls follow customer-configured routing.
Controls
- Per-tenant namespaces with Pod Security enforcement — no privileged containers, one agent job per node
- Per-tenant network policies; tenant boundaries regression-tested in CI
- Per-user provider credentials — no shared accounts
- Repository and tool scope defined per run
- Customer-owned API keys as a first-class path
- Retries, timeouts, cleanup, and failure handling
- Rate-limit-aware scheduling
- Connected trace: issue, graph, events, and outcome
- Offline license and air-gapped self-host path
Authentication and billing
Runs bill to customer-owned API keys at provider rates. Policy-aware routing applies each provider's terms automatically; sanctioned subscription auth is per-user and per-tenant, with no shared accounts.
Data handling
| Data category | What we access | Where it lives — managed cloud | Retention |
|---|---|---|---|
| Repository code | Cloned and accessed inside the isolated job for the requested run. | Ephemeral job filesystem. The control plane does not persist a repository copy. | Removed with job cleanup; finished jobs have a 30-second TTL. |
| Linear issue and comment metadata | Issue, comment, status, workspace, user, and session identifiers needed to route and report work. | Linear and tenant-scoped control-plane records on DigitalOcean. | Service term; return or deletion within 30 days after termination under an executed DPA. |
| User identifiers | Name, email, organization/workspace ID, and account identifiers used for auth, billing, and audit. | Keycloak and tenant-scoped control-plane records. | Service term; return or deletion within 30 days after termination under an executed DPA. |
| Run telemetry | Outcome, provider/model, duration, cost estimates, CI result, and failure reason. | Tenant-scoped PostgreSQL and Temporal; diagnostic errors may be sent to Sentry. | Temporal history: 7 days. Event partitions: 3 months. Other tenant records follow the service term and DPA termination window. |
| Agent session logs | Prompts, output, tool events, elicitation, artifacts, and lifecycle events associated with a run. | Tenant-scoped session/event records; pod logs exist for the life of the job. | Pod logs: job lifetime. Session records follow the service term and DPA termination window. |
Managed-cloud offboarding: the draft DPA provides return or deletion within 30 days after termination and certification on request; this becomes contractual when signed. Deleted PostgreSQL data may remain beyond use in DigitalOcean's daily backups for up to 7 days before expiry.
Self-hosted: retention remains under customer control unless support access is explicitly granted.
Subprocessors
Managed cloud runs on DigitalOcean (LON1 — London, United Kingdom), uses Linear as the issue and session command surface, and sends diagnostics to Sentry, which is configured to exclude personally identifiable information by default with no session replay. See the subprocessor list for entities, purposes, and change notifications.
AI model providers are customer-directed. Anthropic, OpenAI, GitHub, and Google are engaged through the customer's own API keys or sanctioned per-user subscription auth and remain governed by the customer's agreements with those providers.
Identity and access
- SSO/OIDC: Keycloak provides the identity layer; Kong validates JWTs at the API boundary.
- Per-user credential mapping: provider credentials are mapped to each engineer and tenant; shared accounts are not the operating model.
- Run scope: tenant job secrets contain only approved repository, provider, Linear, and tool credentials for that job.
- Callbacks: agent callbacks use HMAC-SHA256 signatures with constant-time verification.
- Audit trail: issue/session IDs, graph and node execution, events, outcomes, and failure reasons are connected for each run.
Assurance status
- Mutual NDA and DPA: DPA draft available for legal review; mutual NDA in preparation.
- Penetration test: not yet conducted.
- SOC 2 Type I: not certified; no audit is in progress.
This page is an overview only. No certification, independent attestation, completed penetration test, or active SOC 2 audit is claimed.
Contact
Security questions: security@thriveondev.com. Pilot and procurement enquiries: info@thriveondev.com.
ThriveOnDev Ltd · Company no. 14781768 · Registered in England and Wales