Someone wants to run coding agents on your private repos in a vendor's sandbox. You want to know where the code goes, what is kept and who holds the keys. Benchmark runs happen in isolated, short-lived Fullbeam sandboxes using your own model provider keys, and only what the decision needs is kept.
Every result links back to the setup, the tasks and the commit it came from. If something wasn't measured, you see that too, instead of a number that looks complete.
Repo state, task text, prompts, patches and hidden tests stay inside short-lived Fullbeam sandboxes that are destroyed afterwards. The agent's sandbox gets a short-lived token, not your provider keys, and tests run in a separate sandbox with no model credentials. Your GitOps, MDM or internal platform still decides what gets deployed.
By default Fullbeam keeps component hashes, version history, scores, measured cost, coverage and redacted outcomes. The default record leaves out raw source, command text, tool output, provider keys, hidden tests and model reasoning. GitHub review features have their own data flow, documented on the Trust page.
Compare the tools, permissions, models, plugins and subagents approved for a setup with the ones seen during the run.
Partial telemetry, an unknown model route or a missing runtime event lowers coverage. Confidence stays withheld until someone fixes the gap or explicitly accepts it in the decision record.
A missing record stays Unknown. Fullbeam never turns a gap into a compliance claim, a clean result or a passing setup. Fullbeam is not SOC 2 or ISO 27001 certified, and the Trust page lists what is in place and what is still planned.