Inth

Inth acts in one ecosystem class. Code Audit connects through the Inth GitHub App to read repositories and pull requests, Inbox findings can open GitHub issues, and autofixes propose code changes. Website Audit reads the customer's public site. The c15t integrations (analytics tags and pixels) gate third party scripts behind consent in the customer's app; they are not tools an agent calls. The surface is deep but stays inside GitHub.

SourceInth, inth.com/docs llms-full.txt (Code Audit, Inbox, REST API) and c15t.com docsread 2026-09-25

No workflow the customer builds or runs. Findings land in an Inbox with statuses and can be routed to a reviewer, which is a review queue, not multi step or multi agent execution. The YC listing mentions code native workflows for consent and data subject requests; the docs describe hosted consent projects and audits, not a workflow model.

SourceInth, inth.com/docs llms-full.txt (Inbox, Code Audit, Consent)read 2026-09-25

Inth Agent grounds each answer in the customer's own product record: scans, runtime signals, consent configuration and history, decisions, and the policy pages (privacy policy, cookie policy, terms) the customer connects to a project, with citations to that evidence and to privacy law. The context is assembled per question from those records; no maintained index, graph or embeddings layer over the customer's documents is described.

SourceInth, inth.com/agent and inth.com/docs llms-full.txt (Inth Agent, Code Audit); inth.com/agent.mdread 2026-09-25

Decisions are reserved to people, with no approval gate of Inth's own. Code Audit findings are evidence for review, not final legal conclusions; the Agent's answers go to the person reviewing the change and preserve human judgment; findings are routed and the decision is kept beside the change. Autofixes are proposed code changes that land through the customer's own pull request review, a gate the customer already owns.

SourceInth, inth.com/agent, /code-audit and /docs llms-full.txt (Code Audit); inth.com/agent.mdread 2026-09-25

Access controls are documented, while the compliance attestations are still pending. The REST API names an access model: owner, admin and member roles, with admin or owner required to create projects or manage API keys, OAuth scopes per capability (for example members.write, code-audit.write), and organization API keys carrying a fixed read scoped set.

The trust center (Comp AI, trust.inth.com) lists SOC 2 Type 1 and SOC 2 Type 2 as in progress, alongside 25 policies, 35 controls and 3 subprocessors. Neither attestation is complete yet, and privacy governance is what the product sells rather than a statement of its own security posture.

SourceInth, trust.inth.com and api.inth.com/openapi.json (securitySchemes)read 2026-09-25

The agent's output carries provenance, not a run trace. Each Code Audit finding keeps cited evidence excerpts and the repository, branch, commit and directory scanned, and Agent answers cite the records behind each claim. No per run view of the steps taken or tools called is described. The consent records and Website Audit runtime signals are the customer's operational estate (end user consent and site behavior), not the agent's activity.

SourceInth, inth.com/docs llms-full.txt (Code Audit, Consent records, Inth Agent)read 2026-09-25

No memory layer. Inth Agent is organization scoped and answers from the product record, but that record (scans, findings, decisions, consent history) is the application's data model, not memory the agent retains. Consent records stored for end users belong to the consent product.

SourceInth, inth.com/docs llms-full.txt (Inth Agent, Consent records)read 2026-09-25

A documented selection surface and a customer environment option. Each consent project is created in a region the customer chooses (the REST API creates a project and its consent runtime in the chosen region, with a regions endpoint), and the docs tell customers to pick it for data residency. The BYOC license self hosts the entire Inth platform inside the customer's own infrastructure, keeping code and scan data within that boundary, and the open source c15t backend self hosts.

SourceInth, inth.com/docs llms-full.txt (Create a consent project, REST API projects), inth.com/pricing and c15t.com self host docsread 2026-09-25

No prebuilt agents or templates a buyer adopts. Near misses: c15t's consent banner, dialog and widget components are frontend code, and policy packs are region based consent settings the hosted runtime applies as rules. Neither is an agent or template that does work when selected. The YC listing also mentions workflow building blocks.

SourceInth, inth.com/docs llms-full.txt (Policy packs) and c15t.com docs (components)read 2026-09-25

Work starts without a caller. Once a repository is linked, pull request automation scans each pull request's diff as it opens (the continuous option; scheduled full repository audits are not offered), and the Startup plan runs scheduled Website Audits. Both an event and a schedule can wake it.

SourceInth, inth.com/docs llms-full.txt (Code Audit pull request scans, Pricing)read 2026-09-25

Vendor routed models, no customer choice. Code Audit investigations run AI models through Inth's own AI gateway to its model providers, under zero data retention agreements; the providers are not named and the customer does not select or route models.

SourceInth, inth.com/docs llms-full.txt (Code Audit data handling)read 2026-09-25

A documented public REST API for Inth's own platform, with an OpenAPI specification (25 paths covering organizations, projects and their consent runtimes, members, API keys, Code Audit scans and issues, Inbox findings and billing), bearer auth with API keys or scoped OAuth tokens, and a versioning and deprecation policy. The Inth CLI (npm @inth/cli, JSON output) and an MCP endpoint with user delegated OAuth 2.1 (api.inth.com/mcp) sit on the same surface. The YC listing also cites c15t npm downloads.

SourceInth, api.inth.com/openapi.json and inth.com/docs llms-full.txt (REST API, CLI, Inth MCP)read 2026-09-25

No surface tests or evaluates an agent. Code Audit and Website Audit evaluate the customer's own code and website for privacy issues, which is the product's function over the customer's artifact, not an evaluation of agent behavior; nothing scores or tests Inth Agent's answers or any customer agent.

SourceInth, inth.com/docs llms-full.txt (Code Audit, Website Audit)read 2026-09-25

Website Audit visits the pages the customer lists (the homepage plus up to 20 more, in each chosen region) and records the scripts, cookies, vendors, consent state and Global Privacy Control handling that load, without a person driving it. That is page loading at run time, in the manner of web scraping or a headless fetch; nothing documents the audit clicking, filling or navigating an interface.

SourceInth, inth.com/docs llms-full.txt (Website Audit)read 2026-09-25