DocsConnectorPrivacy

Privacy & Security

The connector is built on one rule: your source code never leaves your machine.

Does Claude see my source code?

No. The connector only receives a privacy-safe subset of your Quell report. Here is exactly what it can see:

What Claude seesExample
Test namestest_payment_rejects_zero_amount
Confidence scores94 (0–100)
Confidence tiersHIGH / MEDIUM / LOW
Flagged item locationssrc/billing.py:42
Flagged item reasonsexternal API: stripe.Charge.create()
PRS score71/100
Edge case counts23 total, 8 written, 3 scaffolded, 2 flagged

What never leaves your machine

What stays localWhy
All source codeYour implementation logic
All test bodiesThe actual assert lines Quell wrote
All docstringsYour documentation
Variable names inside functionsRuntime state
Full file contentsOnly file:line references are synced
Git history and diffsNot relevant to the connector
Environment variable valuesNever collected

Enforcement

The sanitizer (quelltest/sync/sanitizer.py) is the only code path that can produce an outbound sync payload. It enforces an allowlist — any field outside the allowlist raises SanitizationError before the network call is made.

The full published schema: quelltest.com/docs/sync-payload

Audit what was sent

quell sync status --privacy
Sync enabled: yes (Pro tier)
Project: payments-service
Last push: 2026-06-07 10:00:00
What gets sent: test names, confidence scores, flagged reasons, PRS, file:line
What stays local: all source code, all test bodies, all docstrings
View full schema: https://quelltest.com/docs/sync-payload

Connector auth vs LLM auth

Connecting to Claude.ai is independent from enabling LLM fallback in the CLI.

  • Connecting the Claude connector does not enable quell find --use-llm
  • You can use the connector without ever enabling LLM fallback
  • They are separate opt-ins requiring separate authentication

Delete your data

quell sync unlink

This sends a DELETE /v1/projects/:id to api.quelltest.com and removes all synced reports. Claude will immediately lose access. The local sync history is also cleared.

Sync is always opt-in

sync = false is the default in [tool.quell]. Quell never auto-syncs.

[tool.quell]
sync = false  # default — must explicitly opt in

You must either set sync = true in config or pass --sync explicitly on each run.