Snapshot 253724

Document
Security page
URL
https://blitzy.com/security
Fetched
HTTP status
200
Content type
text/html; charset=utf-8
Fetch mode
static
Size
420162 bytes
SHA-256 (raw)
30b1d98927cc6d0c198ab8f8e6c785060e867aa2b7587075e33007d6daa7df91
SHA-256 (normalized text)
38c9346c5dda9b8ec0a21783820a4a3acb7ec3f8f1b77c5d073717cf6dcca5b7

Normalized text

Scripts and page chrome removed; this is what change detection compares.

Blitzy Public Build: Bring An Idea, Get Up To 100k Lines Of Code Generation, At No Cost
Read the blog
Blitzy Public Build: Bring An Idea, Get Up To 100k Lines Of Code Generation, At No Cost
Read the blog
Blitzy Public Build: Bring An Idea, Get Up To 100k Lines Of Code Generation, At No Cost
Read the blog
SOC 2 type II compliant
ISO 27001 certified
Built for trust.
Built for trust.
Built for trust.
Blitzy is designed for the enterprise, with security and compliance at the core from day one.
Visit our trust center
Visit our trust center
No training on your code
Blitzy never trains on user code. And we never store your code directly. Instead, solely store embeddings, ensuring your IP remains fully protected.
Secure end-to-end encryption
All customer data is encrypted in transit and at rest. We use industry-leading encryption protocols to ensure complete data security.
Air-gapped code generation
Our code-generation platform is completely isolated, not accessible via our user-facing interface or publicly over the internet, creating an air-gap for maximum security.
Inbound-only VPC architecture
Blitzy’s platform is an inbound-only, VPC-based system that never initiates outbound requests. The platform also has no publicly exposed endpoints, dramatically reducing the attack surface.
Flexible deployment options
Flexible deployment options
Flexible deployment options
Six ways to run Blitzy, from fully managed SaaS to air gapped premises.
BLITZY · DEPLOYMENT ARCHITECTURE
Where Blitzy runs: six deployment modes
Every mode runs the same platform: a web app and API, a prompt sanitizer and agentic orchestration in the control plane, single-use job VMs in the execution plane, and a per-customer knowledge graph (a hybrid graph+vector database) in the data plane. What changes is who hosts each part, where your code is processed, and which network paths cross your perimeter.
Your environment (solid border)
Blitzy-hosted or external service (dashed)
Inside your perimeter
Hosted by Blitzy
MODE
1 · CLOUD
SaaS
2 · CLOUD
STS
3 · HYBRID CLOUD
Hybrid VPC
4 · CLOUD (YOURS)
VPC Blackbox
5 · CLOUD (YOURS, GOV)
VPC Blackbox Gov
6 · ON-PREMISES
On-premises Blackbox
Multi-tenant, Blitzy-managed
Single-tenant, Blitzy-managed
STS plus the Blitzy Client, a packet router in your network
Full stack in your private cloud, customer-managed
Full stack inside your FedRAMP High or DoD IL4/IL5 cloud boundary, customer-managed
Physical appliance at your site
Hosted and operated by
Blitzy, on shared infrastructure with a public cloud provider
Blitzy, in a cloud project and VPC dedicated to you
Blitzy runs the STS project; you run the Blitzy Client router in your DMZ
You, in your own cloud provider account
You, in your government cloud account, inside your authorization boundary
You, on Blitzy-supplied hardware inside your data center
Control plane (web app, API, orchestration)
Shared Blitzy platform
Your dedicated project
Your dedicated STS project
Your Kubernetes cluster, installed by Helm
Your Kubernetes cluster, installed by Helm from images in your own registry
On the appliance
Execution plane (clone, build, test)
One single-use VM per job, never reused
One single-use VM per job, dedicated to you
Job VMs in STS reach your internal Git-based SCM, packages and test databases through the Blitzy Client
Single-use job VMs in your account
Hardened single-use job VMs in your account, destroyed after each task
Single-use job VMs on the appliance
Data plane (graph, specs, secrets)
Per-company knowledge graph and bucket, isolated by tenant ID
Dedicated knowledge graph, storage and secrets store; customer-managed keys optional
Dedicated, in STS; credentials encrypted with your key (CMEK)
Your cluster, storage, secrets vault and keys
Your cluster, storage and vault; FIPS 140-validated encryption, keys in your KMS or HSM
On the appliance
AI model inference
Frontier LLM providers; zero data retention, no training
Same providers, from your dedicated egress IPs
Same providers, from STS; Blitzy’s keys or, optionally, your own
Model endpoints you approve, through your egress controls
Government-cloud LLM endpoints you approve; all other model APIs disabled
Open-weight models served on the appliance’s GPUs
What crosses your perimeter
Repository clone into Blitzy over HTTPS; branch and pull request back
Same, to your dedicated project only
One outbound link from the Blitzy Client (TCP 443, mTLS). Blitzy never dials in.
Model calls and release pulls, through egress you control
Nothing by default: no call-home, model traffic stays in your cloud; signed packages you scan and approve
No outbound connection required; updates arrive as signed packages
Ways to connect to your systems
Public endpoints with IP allowlist, private link, or site-to-site VPN
Same three options, terminating in your dedicated VPC
Blitzy Client link over the internet or inside your IPsec VPN
Private, inside your network
Private, inside your network; SSO through your government IdP with MFA and CAC/PIV
Private, inside your network
Compliance posture
Covered by Blitzy’s SOC 2 Type II report and ISO 27001 certification
Covered by Blitzy’s SOC 2 Type II report and ISO 27001 certification, on infrastructure dedicated to you
STS is covered by Blitzy’s SOC 2 Type II report and ISO 27001 certification; the Blitzy Client runs under your controls
Runs under your cloud controls. Blitzy holds a SOC 2 Type II report and ISO 27001 certification.
Runs in your FedRAMP High or DoD IL4/IL5 authorized cloud, under your agency’s ATO.
Runs under your site controls. Blitzy holds a SOC 2 Type II report and ISO 27001 certification.
Personnel access
Blitzy support staff can reach the platform to help you; nothing reaches into your network
Blitzy support staff, scoped to your dedicated project
Blitzy staff work in STS only; nothing dials into your network
Only the access you grant
No standing access to your data plane; sessions you approve, time-limited, logged, US persons only
No standing access; only sessions you allow
Audit and supply chain
Sign-in and activity events export to your SIEM; every change is a pull request
Project-scoped audit logs, exportable to your SIEM
Same as STS, plus a signed Blitzy Client package
Logs and traces stay in your account; signed images and Helm chart
Logs and agent traces stay in your boundary, export to your SIEM; signed, scanned images, Dockerfiles, Helm chart and SBOM
Logs stay on the appliance; signed update packages
Availability
Standard
On request
Deal-specific
Deal-specific
Deal-specific
Deal-specific
In every mode: no AI agent has a network path into your environment, prompts are screened before any model sees them, agents receive task-scoped code snippets rather than whole repositories, and every change arrives as a pull request under your branch protection.
Deployment architecture and data flow
Deployment architecture and data flow
SaaS
STS
Hybrid VPC
VPC Blackbox
VPC Blackbox Gov
On-premises Blackbox
SaaS
STS
Hybrid VPC
VPC Blackbox
VPC Blackbox Gov
On-premises Blackbox
SaaS
STS
Hybrid VPC
VPC Blackbox
VPC Blackbox Gov
On-premises Blackbox
Frequently asked questions
Frequently asked questions
What is Blitzy?
Blitzy enables development teams to transform six-month software projects into six-day turnarounds using Blitzy OS, an agentic platform that enables thousands of AI Agents to 'think' and cooperate for hours to bulk build software with precision. The platform builds everything AI can deliver in a precise manner, around 80% of any roadmap or new product, supplemented with a human engineering guide to complete the remaining 20% needed for production. With over 27 patents and counting, Blitzy is actively hiring PhDs and senior developers in Cambridge, MA who have a passion for building AI that leverages 'System 2 Thinking' to solve problems at inference.
Who is Blitzy for?
Enterprises that aim to dramatically accelerate their software development velocity, development agencies with enterprise clients, development teams with complex existing products, and individuals looking to accelerate their own velocity on complex builds.
How does Blitzy’s technology work?
Our patent-pending code ingestion framework maps a curated selection of robust, reliable, and secure open source software libraries that we track by version and update frequently. Combined with our proprietary code generation technology that specializes on enforcing enterprise-class software policies, Blitzy far exceeds the utility of typical chatbots and co-pilots in creating enterprise-grade software at scale.
Is Blitzy a coding co-pilot?
Nope. Blitzy surpasses traditional co-pilots with its ability to autonomously generate nearly-complete code repositories, not just snippets. It features a daily-refreshed knowledge base, avoiding the pitfalls of outdated information. Blitzy's proprietary codebase representation system enables deep understanding of generated code, offering highly contextual and relevant suggestions for your entire repository.
What's my role in Blitzy's development process?
Your team is responsible for bringing the requirements, and as an approver during the technical specification stage. We ask you to edit/approve the Technical Specification. The document is editable, so you can edit and approve to get exactly what you had in mind.
How does Blitzy decide which tasks to delegate to human developers?
Blitzy's multi-agent system is meticulously and rigorously trained to know what it can accomplish, and what needs to be left for the human engineers. This ensures you only receive quality code and have a clear picture of remaining tasks.
Does Blitzy do more than just autonomous code generation?
Yes. Blitzy is a comprehensive platform that provides end-to-end development assistance. We support the entire development lifecycle by taking descriptive inputs and generating software requirements documents, technical design, code structure, and generative code within repos for your product.
Is this high quality and secure?
Quality and security matter deeply to us — and they were our biggest frustration with the copilots already on the market. That frustration is what led us to build something different: a system designed to meet enterprise standards from the start. Every piece of work passes through multiple QA agents that review each other's output before any code reaches you, so what you receive is held to a consistent quality bar rather than the variable output typical of single-pass code generation. We deliver enterprise-grade code repositories. As with any code entering your environment — written by humans or AI — your team should still run its own QA, QC, and security testing before deployment. We build to a high standard and give your reviewers a strong starting point; final validation stays with the team that owns the production environment.
After submitting my prompt, Blitzy added functionality in my tech spec that I did not expect. What do I do?
The system defaults to taking advantage of all technology upgrades when modernizing or upgrading to the latest technology stack. For example, if you specify an upgrade to Java 21, the system will by default implement virtual threads, as it's generally seen as a superior technical approach. If you do not want this, you must simply tell the system to 'make as few changes as possible to achieve the desired request'. Being as specific as possible about what functionality is (and is not) desired helps yield results that will align with expectations.
What do Blitzy agents rely on as a source of truth to represent my existing codebase?
Blitzy agents rely on the actual source code of your existing codebase—not the Tech Spec documentation—when performing refactors or extending functionality. However, an accurate Tech Spec significantly aids the system's efficiency in querying the underlying representation of the code. Therefore, investing time to ensure the Tech Spec reflects the core features of the application will yield expectation-aligned results and will save time with last-mile development.
Can Blitzy work with existing products and code bases?
Yes! Blitzy excels at working with existing codebases, using them as a foundation to ensure consistent, high-quality development. The platform enables you to add new features to existing products, generate comprehensive documentation, and tackle technical debt by upgrading legacy systems to state-of-the-art technologies or refactoring complex codebases. Our platform deploys dedicated AI agents that map and understand your codebase before generation, ensuring intelligent, contextualized development that aligns with your existing patterns and standards.
What programming languages does Blitzy support?
Blitzy's AI platform works with all programming languages.
How should I structure my prompts for Blitzy?
Structure and organization are crucial when prompting Blitzy. The most effective prompts follow our prompting template with clear sections for WHY (vision & purpose), WHAT (core requirements), and HOW (technical details, user experience & implementation priorities). Each section should be detailed but concise, focusing on essential information while providing relevant context. Including structured frameworks and concrete examples - like data models, user stories, or feature templates - helps Blitzy deliver more precise and purposeful solutions.
What information does Blitzy need to compile and run my code?
During code generation, Blitzy compiles your codebase and performs runtime validation to ensure the generated code works correctly. To enable this, we require: (1) Internal dependencies - any private packages, libraries, or binaries not publicly available that your code needs to build and run, (2) Environment variables and secrets - API keys, credentials, and configuration values required for compilation and runtime (shared securely through our encrypted UI, never exposed to AI agents), and (3) Build instructions - the specific steps or scripts needed to compile your code, typically found in your README or setup documentation. This information allows Blitzy to replicate your development environment and verify that all generated code functions properly before delivery.
How can I exclude certain files or folders from Blitzy's code generation?
Create a .blitzyignore file in your repository's root directory to specify which files or paths Blitzy should exclude during tech-spec generation and code generation. This works similarly to .gitignore - simply list the file patterns, directories, or specific files you want Blitzy to skip, using standard gitignore syntax like *.log, /build/, or config/secrets.json. To ensure Blitzy respects these exclusions, mention in both your codebase context prompt and target state prompt that Blitzy should reference the .blitzyignore file and exclude those paths from processing.
Can I cancel my project/job (code gen) once in progress?
At this time, jobs are not cancelable. Once you submit, it consumes the assigned quota.
Build enterprise
software in days,
not months.
Build enterprise software in days, not months.
Start building
Talk to an expert
Build enterprise software in days, not months.
Start building
Talk to an expert
Blitzy
One Kendall Square,
Cambridge,
MA 02139
© 2026 Blitzy. All rights reserved
Product
Overview
Use-cases
Security
Pricing
Company
About us
Careers
Support
Help
Service status
Trust center
Resources
Docs
Blog
Videos
Social
YouTube
LinkedIn
Legal
Website Privacy Policy
Platform Privacy Policy
Terms of Use
Sandbox Terms of Use
Blitzy
One Kendall Square,
Cambridge,
MA 02139
© 2026 Blitzy. All rights reserved
Product
Overview
Use-cases
Security
Pricing
Company
About us
Careers
Support
Help
Service status
Trust center
Resources
Docs
Blog
Videos
Social
YouTube
LinkedIn
Legal
Website Privacy Policy
Platform Privacy Policy
Terms of Use
Sandbox Terms of Use
Blitzy
One Kendall Square,
Cambridge,
MA 02139
© 2026 Blitzy. All rights reserved
Product
Overview
Use-cases
Security
Pricing
Company
About us
Careers
Support
Help
Service status
Trust center
Resources
Docs
Blog
Videos
Social
YouTube
LinkedIn
Legal
Website Privacy Policy
Platform Privacy Policy
Terms of Use
Sandbox Terms of Use