diffray
diffray is a multi-agent AI code review platform for engineering teams on GitHub: it installs as a GitHub App and comments on pull requests. Free for public repositories, with a 14-day trial on paid plans.
What is diffray?
diffray is an automated code review service that installs as a GitHub App and posts its findings as inline comments on pull requests. Its argument is stated on the home page: The problem isn’t AI. The problem is single-agent AI. Rather than asking one model to judge a diff, diffray runs a set of specialised agents that cross-check each other, then reconciles their output before anything reaches the developer.
The announced chain runs from the pull request event to a context analysis, then to the specialised agents, then to a deduplication pass and a final review. The agents documented on the agents page are the Security Expert, Performance Specialist, Bug Hunter, Quality Guardian, Architecture Advisor, Consistency Checker, Documentation Reviewer, Test Analyst, General Reviewer and SEO Expert. diffray claims to read the whole repository rather than the diff alone, which is what supports its consistency checks against existing conventions. Two third-party engines are embedded: Semgrep for static analysis, with 2,000+ rules announced, and TruffleHog for secret detection, with 700+ secret types announced. The reasoning engine is Anthropic’s Claude, credited as “Powered by Claude” in the home page footer. The vendor announces reviews in under two minutes for most pull requests, and up to five minutes beyond 1,000 lines.
A separate command-line tool exists, free and open source: installed with npm install -g diffray, it needs no account, runs locally, ships five agents rather than the full platform set, and leans on an existing Claude Code or Cursor subscription.
Two caveats belong in any description of this product. First, the performance figures on the home page — 87% fewer false positives, three times more real bugs, a 98% action rate — are the vendor’s own, explicitly footnoted “*Based on internal testing”. Second, the site does not agree with itself on how many agents it runs: 30+ on the about page, 11 on the agents, integrations and comparison pages, 10 in the title tag of the agents page, 10+ in the FAQ, 5 for the CLI. The publisher, diffray, Inc. of Delaware, registered its domain on 11 November 2025 and was first archived by the Wayback Machine on 3 January 2026: this is a very young product, and it reads like one.
What it does
- Reviews every pull request opened on a connected GitHub repository, automatically
- Flags security issues: OWASP Top 10 vulnerabilities, injection flaws and exposed secrets
- Hunts bugs, race conditions, edge cases and memory leaks
- Checks consistency with the rest of the repository: conventions, duplication, type drift
- Deduplicates findings so that each issue is raised only once
- Filters weak findings through a confidence score to cut the noise
- Applies house rules written in YAML and versioned inside the repository
When to use diffray / When not to
A quick filter to help you decide if diffray is the right fit.
When to use diffray
- Engineering teams that live on GitHub with a steady flow of pull requests, including fintech and healthcare squads, for which diffray publishes dedicated pages referencing PCI-DSS, SOC 2 and HIPAA/PHI checks.
- Small teams of one to ten developers, the audience of the Solo and Team plans, with no budget for a dedicated code reviewer.
- Open source maintainers: public repositories under an OSI-approved licence get unlimited reviews free of charge, with no application process.
- Teams already worn down by the noise of another AI reviewer, since cutting false positives and duplicate comments is diffray’s explicit positioning.
- Individual developers who want a check before pushing, through the free command-line tool that runs locally and needs no account.
When not to use diffray
- Teams working on GitLab or Bitbucket: the integrations page lists both as “Coming Soon” behind a waiting list.
- Workflows outside Git and pull requests: on the hosted platform, nothing is analysed until a pull request is opened.
- Anyone who needs a public API: no API documentation was reachable, docs.diffray.ai returning HTTP 402 on every path tested.
- Organisations that require a valid SOC 2 attestation or EU data residency: the security page dates its own certification to Q4 2026, and every disclosed subprocessor sits in the United States.
- Teams that need a self-hosted deployment today, and anyone under 16: on-premise is still an early-access form, and the terms set 16 as the minimum age.
How to use diffray
A typical end-to-end flow, from setup to results.
- Sign in with your GitHub account through OAuth
- Install the diffray GitHub App on your organisation or personal account, then pick the repositories it may read
- Configure the review: choose which agents run and set your team rules
- Optionally commit a .diffray YAML configuration file to the repository to encode house rules
- Open a pull request as usual: no code change and no CI/CD pipeline change are required
- Wait a few minutes for the inline comments, announced by the vendor at under two minutes for most pull requests
- Read, resolve or dismiss the comments, each issue being raised only once according to the vendor
- Alternatively, install the free CLI with npm install -g diffray and run diffray review inside a local Git repository before pushing
Pros & Cons
Pros
- Low, readable pricing next to the comparison grid the vendor publishes: 9 to 10 USD per developer per month
- Free and permanent for public repositories under an OSI licence, with no application to file
- A free, open source CLI that needs no account and keeps the code on the developer’s machine
- A detailed and repeated commitment not to retain code: an ephemeral container destroyed at the end of each review
- An explicit commitment never to train models on customer code
- Subprocessors named and located, both in the privacy policy and in a DPA readable online without a form
- Installs without touching the CI/CD pipeline, and every plan includes unlimited reviews
Cons
- Documentation unreachable: docs.diffray.ai returned HTTP 402 Payment Required on /, /faq and /security, although it is linked from the navigation of every page
- GitLab and Bitbucket appear as integrations on the home page but are listed “Coming Soon” with a waiting list on the integrations page
- Hosting and subprocessors are exclusively United States based, with no EU data residency option and no Article 27 EU representative
- No full postal address: “Delaware, USA” is all that is published, with no named officer
- Performance figures are uncorroborated and explicitly presented as the result of internal testing
- The site contradicts itself on the number of agents, the number of rules and its SOC 2 status
- No accessible documented public API, and no identifiable customer review: testimonials carry job titles only, with no name or company
Pricing & Plans
diffray operates on a freemium model. Public repositories under an OSI-approved licence are covered by a free, permanent Open Source plan with unlimited reviews, and a free open source command-line tool is available separately. The cheapest paid entry point is the Solo plan at 10.00 USD per month for one developer. The Team plan is advertised at 9 USD per developer per month, but requires at least three seats, that is 27 USD per month. Flat-rate tiers follow at 79 USD (Growth) and 149 USD (Scale) per month, with Enterprise pricing on request. Annual billing is advertised at 20% off, and paid plans open with a 14-day free trial that requires no credit card.
- public repositories
- unlimited reviews
- all agents
- 1 seat
- unlimited reviews
- all agents
- custom rules
- 3 to 10 seats
- everything in Solo plus priority support
- 11 to 25 developers
- everything in Team plus dedicated support
- 26 to 50 developers
- 50+ developers
- dedicated account manager
Data, GDPR & hosting
A consolidated view of how diffray handles your data.
GDPR overview
The privacy policy carries a section for the EU, the UK and Switzerland. The legal bases cited are contract performance, legitimate interests, consent and legal obligation; the rights listed cover access, portability, rectification, erasure, restriction, objection and withdrawal of consent, with a complaint route to the local supervisory authority. Requests go to privacy@diffray.ai, with a 30-day response commitment. A DPA is published openly, a counter-signed copy is offered within two business days, breach notification to the customer is promised within 72 hours where feasible, and transfers rely on EU standard contractual clauses plus a UK addendum. CCPA, LGPD, PIPEDA and other regimes are addressed too. No Article 27 EU representative and no DPO are named anywhere on the site, and the “GDPR-compliant data handling” line on the security page is the vendor’s own statement, not an audit.
Who owns the data?
The customer keeps ownership of its source code and of the data it submits. The terms grant diffray a limited licence, restricted to processing that code for the purpose of running a review, and the security page repeats the commitment in plain words: “You retain all ownership rights to your code. Always.” The vendor also states that customer code is never shared with other customers or with third parties beyond the subprocessors it discloses. The declared controller is diffray, Inc., Delaware, USA, reachable at privacy@diffray.ai. These are contractual commitments published by the vendor; no external audit of them is available.
Reuse rights
The privacy policy limits processing to authenticating users, analysing submitted code to produce review suggestions, improving the service and communicating with customers. Source code is said to run in an ephemeral container destroyed once the review ends, and both the security and privacy pages state that customer code is never used to train AI models — the reasoning engine is Anthropic’s Claude API, which the site says does not train on API data. Five subprocessors are named, all located in the United States: AWS (infrastructure), Anthropic (AI), GitHub (authentication and repositories), Stripe (payments) and Vercel (hosting). Transfers outside the EEA rely on standard contractual clauses and a UK addendum, and the policy states that personal data is not sold. No training opt-out is published, since the vendor states that no such training takes place.
Data retention & training
Hosting summary
diffray declares an AWS infrastructure with VPC isolation and private subnets, and states that its internal services are not publicly reachable. The web application itself is hosted on Vercel. All five disclosed subprocessors sit in the United States: AWS (infrastructure), Anthropic (AI), GitHub (authentication and repositories), Stripe (payments) and Vercel (hosting). No EU region and no data residency option is offered. Source code is said never to be stored: it is processed in an ephemeral container with no persistent storage, destroyed at the end of the review. Encryption announced on the security page is TLS 1.3 in transit and AES-256 at rest, where the DPA states “TLS 1.2+”. Transfers outside the EEA rely on EU standard contractual clauses and a UK addendum. DNS resolution observed on 11 August 2026 pointed to 216.198.79.1, an Amazon (AS16509) address in the United States. In practice, a European customer should expect its repository metadata and review results to be processed under United States jurisdiction.
Things to keep in mind
Risks and trade-offs to weigh before adopting diffray.
- The documentation is linked from the navigation of every page but was unavailable when checked on 11 August 2026: docs.diffray.ai returned HTTP 402 Payment Required on /, /faq and /security. A team therefore cannot read the setup or API guides before subscribing. A 402 can be temporary, so the check is worth repeating.
- The site contradicts itself on SOC 2. The FAQ states “diffray is SOC 2 Type II compliant. We undergo annual third-party audits”, while the security page files “SOC 2 Type II certification” under “Planned Q4 2026” and claims only “AWS SOC 2 Type II infrastructure” as its current status, home page badges reading “SOC 2 Infrastructure” and “SOC 2 Infra”. No certification of diffray’s own is established: do not carry the claim into a procurement file without written confirmation.
- The counts do not match from one page to the next. Agents: 30+ on the about page, 11 on the agents, integrations and comparison pages, 10 in the title tag of the agents page, 10+ in the FAQ, 5 for the CLI. Rules: 1,300+ on the about page against 100+ on the agents page. Languages: “30+ Languages Supported” is advertised for a list of eleven languages actually named.
- What is available today is described differently depending on the page: GitLab and Bitbucket are shown as integrations on the home page, as “Coming Soon” with a waiting list on the integrations page, and as working in the FAQ (“Yes, diffray supports GitLab integration”); on-premise is marked “Available” on the integrations page while the product page offers a “Get Early Access” form; a “Pro” plan appears in the FAQ and in the pricing JSON-LD though no such plan exists in the grid; and Growth is capped at 11-25 developers on the pricing page but described as “unlimited developers” in the FAQ.
- Retention and encryption figures diverge between pages: review results are kept 30 days according to the privacy policy and 90 days according to the security page, repository metadata is “deleted with account” on one and deleted within 90 days of disconnection on the other, and encryption in transit is TLS 1.3 on the security page but “TLS 1.2+” in the DPA. The four legal documents are all dated “Last updated: December 21, 2026”, after the 11 August 2026 collection, and dated items are still on display: a “14-day free trial until Feb 18, 2026” banner on the pricing page, and a “Penetration test by third party Q2 2026” still listed as upcoming.
- Social proof cannot be checked. The JSON-LD SoftwareApplication block carries an aggregate rating of 5/5 from 127 votes although the site has no review system, and its three structured reviews are signed by generic personas such as “Senior Engineer at Fintech Startup” and dated January 2025, before the domain was registered on 11 November 2025. On-page testimonials carry job titles only. “Join 500+ engineering teams” comes with no supporting element, and every performance figure, including the 73% faster reviews cited on the contact page, is footnoted “*Based on internal testing”. The publisher itself is identified only as diffray, Inc., Delaware, USA, with no postal address, no named officer and no registration number.
- The last risk is human rather than technical. Comments landing automatically on every pull request invite rubber-stamping, and a confidence filter that suppresses weak findings by design means silence is not proof that a file is clean. Treat the output as a first pass rather than a gate, keep a person accountable for what gets merged, and remember that the terms leave you the owner of the code and, with it, the responsibility for what ships.
Setup & Integrations
Technical difficulty
Low for the hosted product. Setup is a GitHub OAuth sign-in followed by installing the GitHub App on the repositories you select: “setup in a few clicks”, under five minutes according to the vendor, with no code change and no CI/CD modification. No infrastructure skills are required. Optional configuration goes further: choosing which agents run, and writing house rules as .diffray YAML files. The CLI asks slightly more, namely Node and npm plus an existing Claude Code or Cursor subscription. On-premise is the exception: Enterprise only, in early access, and subject to an architecture review with the sales team.
Deployment
Integrations
Supported languages
Behind diffray
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement diffray.
Frequently asked questions
Which platforms does diffray review?
Is my source code stored?
Is my code used to train AI models?
What does it cost to start?
Is it free for open source projects?
Is there a free trial?
How long does a review take?
Which programming languages are covered?
Is diffray SOC 2 certified?
How do I exercise my GDPR rights, and is a DPA available?
Should you pick diffray?
diffray arrives with a clear proposition and low prices on a crowded market where CodeRabbit, GitHub Copilot, SonarQube, Qodo and Greptile already review pull requests. Two things make it genuinely testable rather than merely claimed: public repositories are free forever, and the command-line tool is free, open source and account-free, so a team can judge the output on its own code before paying anything. The confidentiality commitments are unusually detailed and, more to the point, consistent across the security page, the privacy policy and the DPA: ephemeral containers, no code retention, no model training, named subprocessors.
Against that, this is a very young project. The domain was registered on 11 November 2025 and the Wayback Machine first captured the site on 3 January 2026. The official documentation was unreachable at the time of collection, docs.diffray.ai returning HTTP 402 on every path tested, even though it is linked from every page. And the site does not agree with itself: the number of agents changes from page to page, SOC 2 is asserted in the FAQ and dated to Q4 2026 on the security page, GitLab and Bitbucket are integrations on the home page and “Coming Soon” on the integrations page, and the Growth plan is capped at 25 developers in the grid but called unlimited in the FAQ. Every performance figure is the vendor’s own, footnoted as internal testing.
Read this as a dated snapshot, not a recommendation. The offer is coherent and cheap enough to try at no cost; what remains unverified is whether the product, its documentation and its compliance claims will settle into agreement. Before committing to a paid plan, re-check the documentation, the SOC 2 status and the GitLab roadmap directly with the vendor.
- Choosing a selection results in a full page refresh.
- Opens in a new window.