Most of what TrueMend does involves no AI at all. This policy explains precisely where that stops being true, and what governs it when it does.
1. Deterministic-First Is the Design, Not a Marketing Claim
Anti-pattern detection in TrueMend runs on AST analysis (ast-grep), line-scan heuristics, and semantic Python AST analysis, in all cases against a documented, versioned catalog of patterns. No AI model is involved in detection, at any tier, ever. A finding is a finding because it matched a specific, inspectable rule, not because a model judged it. Every finding traces to a named detector with a documented detection method, so "why did this flag" always has a concrete answer.
2. Where AI Is, and Is Not, Involved in Fixes
TrueMend fixes what it finds through three tiers:
- Tier 1, deterministic patches. AST-safe transforms applied automatically, free, with zero AI involvement. Each one is independently re-verified after being applied (Section 5); the original source is restored if verification fails.
- Tier 2, cataloged refactors. Constrained, LLM-assisted fixes from a bounded catalog. The model invoked here is your own configured LLM client, for example your own Claude Code session or MCP client, not infrastructure we operate. TrueMend's servers never see this code and are not part of this exchange.
- Tier 3, structural rewrites. Architectural decisions (god classes, tangled dependency graphs) that only a human should make. TrueMend surfaces evidence and options. A structural rewrite is never applied automatically, by any code path, under any configuration. The decision is always yours.
3. The One Place We Call an LLM Ourselves
TrueMend's own infrastructure calls a model directly in exactly one place: the optional --ci --batch flag, which uses Anthropic's Batch API for CI-pipeline review. This is off by default, requires your own ANTHROPIC_API_KEY, and is billed directly between you and Anthropic; we do not provision or resell model access. Before any request is sent, we run automatic secrets redaction across every field of the payload (the prompt, the file path, and the analysis content) for common secret patterns: API keys, GitHub tokens, AWS access keys, JSON web tokens, and password- or credential-like strings. Code is transmitted wrapped as explicit, delimited data rather than as free-form instructions, to reduce the risk of the content being interpreted as commands to the model. This was verified directly against the redaction function's real invocation in the request-building path, not merely asserted from a design document.
If you have concerns about a specific codebase, do not enable --ci --batch on it: everything else in TrueMend, including Tier 1 and Tier 2, operates without your code ever reaching our servers.
4. Human-in-the-Loop by Design
Every deterministic fix produces a unified diff and is independently re-verified after application (AST re-parse rejects any result containing error nodes; the original file is restored automatically on failure). Structural rewrites are never auto-applied, full stop. Cataloged refactors run through your own LLM client under a constrained prompt scope, and are yours to accept, edit, or discard before they land, exactly like any other change a tool proposes in your own editor or CI. We do not ship, and will not ship, a mode where a model commits code without a human in that loop for anything beyond Tier 1's narrow, independently-verified deterministic transforms.
5. Verification, Not Trust
We do not ask you to trust that a fix is safe; we verify it. Every deterministic transform is re-parsed after being applied and rejected if it produces invalid syntax, with the original source restored automatically on failure. This is a real, automated gate that runs on every fix, not a manual review step that can be skipped.
6. No Training on Your Data
We do not use your code, analysis results, or account data to train any model, ours or a third party's. If you use the optional --ci --batch flag, the code you send is subject to Anthropic's own API terms for that usage, which govern whether Anthropic itself trains on API traffic; we do not control that beyond what our agreement with Anthropic provides, and we encourage you to review Anthropic's own commercial API terms if that distinction matters to your organization.
7. Anti-Pattern Quality Control
Detection rules are not published speculatively. Before a new pattern surface is enabled by default, it goes through a dogfooding pass against real, non-synthetic codebases to check its actual false-positive rate; surfaces that do not clear that bar are quarantined rather than shipped. This is an ongoing, versioned practice reflected directly in what the engine ships with enabled by default, not a one-time claim.
8. Accountability
Structural decisions stay with a human, by design (Section 2). Every automatically-applied fix is traceable: which detector found it, which transform applied it, and the diff that resulted. If you believe a fix caused unintended behavior, contact us (Section 10); we treat a confirmed regression in a deterministic transform as a defect in the transform itself, not an acceptable cost of automation.
9. Compliance Tooling We Offer, and What We Do Not Claim
TrueMend includes a compliance command that checks a codebase against frameworks including SOC2, ISO 27001, OWASP, HIPAA, PCI-DSS, GDPR, the EU AI Act, the NIST AI Risk Management Framework, and ISO 42001. This is a feature we offer for auditing your own codebase. It is not a claim that TrueMend, the company or the product, holds any of these certifications ourselves. Our own certification posture, and the honest absence of third-party certification today, is stated directly in our Security Policy.
10. Changes to This Policy
We will notify active account holders of material changes by email at least 30 days before they take effect. The current version is always at truemend.ai/responsible-ai.
11. Contact
2435316 Ontario Inc., operating as TrueMend, Ontario, Canada.
For questions about this policy or a specific AI-assisted fix: hello@truemend.ai