Talon sits in the path between your coding agent and the model. To add the right context and measure what it saves you, your prompts, the model's responses, and a structural graph of your code are processed on Cogmeta's infrastructure. This is the plain-English version of what that means.
Talon is a hosted service. Your agent's traffic is routed through our proxy and a graph of your code is built and stored on our servers, because that is how the product adds context and measures cost. In exchange we make hard commitments: we never train on your data, we never sell or share it, retention is bounded, and access is least-privilege and logged.
The table on the right is the honest summary — what we process, and the limits we hold ourselves to.
No policy language, no ambiguity. A literal description of what passes through Cogmeta during a typical session.
Want your code and prompts to stay inside your own boundary? Single-tenant and self-host options are on the roadmap.
Four categories. If we add a fifth, it will appear here first and a notice will go out before it takes effect.
talon debug proxy --tail in a project to watch the exact traffic that transits our proxy, and talon debug graph to inspect the structural graph built from your code.For a small, fixed set of purposes — each tied to a specific lawful basis under UK GDPR Article 6:
The distinction that matters: your content — prompts, responses, and the code inside them — is processed only to deliver the service to you. We never use your content to train models (ours or anyone else's) or to improve our product; anything we learn from to make Talon better is our own system-generated metadata, not your content. We do not sell or share data with advertisers, data brokers, or analytics networks, and we do not build profiles across customers.
We don't use cookies for tracking, advertising, or analytics. Session cookies for sign-in only — strictly necessary, no consent banner required under UK PECR.
Talon proxies your agent's requests to third-party frontier model providers on your behalf. Because the proxy is in the path, your prompts and the provider's responses transit Cogmeta before and after they reach the provider. We route only to the provider a request is destined for, and we enforce zero-retention mode on every outbound call where the provider offers it.
You reach a model one of two ways. On Cogmeta credits, we hold the account with the provider and bill you for usage. Bring-your-own-key (BYOK), where offered, forwards the request under your own provider account and key — this changes who holds the upstream relationship, but the request still transits our proxy, so it does not remove Cogmeta from the data path.
Provider zero-retention means your prompts and responses are not retained by the provider beyond the API call, and are never used to train their models. How Cogmeta itself handles that traffic is covered under Data we process and Retention.
Two categories. The live, authoritative list is maintained here; adding one is a sub-processor change (30-day notice per DPA terms), not a change to this policy.
As we add other subprocessors (payment processing, email, etc.), they'll appear here first. Changes get a 30-day notice per DPA terms.
Today, all metadata is hosted in AWS eu-west-2 (London). Customers requiring a specific region (US, APAC) can talk to us — multi-region is on the roadmap. EU/UK transfers use Standard Contractual Clauses where required by the contract.
Defaults — all configurable on Team and Enterprise tiers:
Account deletion triggers a 30-day grace period, after which everything except legally-required records is irrecoverably erased. Erasure proof is available on request.
This retention table is the single source of truth for how long we keep each data category.
TLS 1.2+ everywhere in transit. Encryption at rest using AWS-managed KMS keys. IAM least-privilege with logged operator access. Per-tenant logical isolation; cross-tenant access is structurally impossible.
Audited compliance (SOC 2 Type II, ISO 27001) is on the roadmap, not in place today. We'll publish realistic timelines as they firm up rather than claim certifications we don't hold.
Talon is a developer-tooling product intended for adults building software. We do not knowingly collect data from anyone under 16. If you believe a minor has signed up, email [email protected] and we'll remove the account within 72 hours.
Questions, requests to exercise your rights, or just to say hello:
17078018. Registered office: 71-75 Shelton Street, London WC2H 9JQ. Service-of-process address available on request via the contact form.Data Protection Officer. No formal DPO required at our scale; data-subject queries route to [email protected]. Article 30 Record of Processing Activities available to data-subject regulators on request.
Download everything we hold about you as a signed JSON export. Delivered within 7 days.
Correct any inaccurate personal data directly from the account page or via email request.
Delete your account and all personal data. 30-day grace period, then permanent.
Pause processing while a dispute is resolved. Your workspace continues; analytics pause.
Export your scoring graph and configuration in an open format, importable anywhere.
Opt out of aggregate telemetry. Product continues with graceful degradation of tuning.
Californian residents have the same rights under the CCPA, plus a right to know sales & shares of personal information. We have none to report — we do neither.