We keep the numbers. Never the prompts or the code.
Enterprises will not let their code or prompts be seen or kept. That is a precondition, not a feature, so the architecture says it precisely: stream, don't store; aggregates leave the laptop and raw data does not; the things that must carry content are opt-in, encrypted and expiring.
Precisely what passes through, and what stays.
| surface | passes through | kept | never |
|---|---|---|---|
| the proxy | Requests to your own Claude or OpenAI seat, and back. | Tokens, model, cost, when, the seat, the decision at the wall. | Prompt or completion bodies. Repo contents. Tool output. |
| the record | The PR body's SLEDS-* lines, the brief, the row's fields. | Estimate, worth, actual, receipt, brief, per row. | The diff. The spec body, once the estimate is recorded. |
| the seat reader | Your own usage page, read as you. | Percent per bar, credits, the reset. | Anything else on the account. |
| the connector | What your AI sends to the tools: the request, links, a stated worth, files you attach. | The brief, as confirmed by you. Sources as links; attachments on the row. | The rest of your conversation. |
| Slack and GitHub | What they already show you. | Nothing beyond what we wrote there. | Membership, permissions, message history. |
Three features carry content because they cannot work without it.
Sensitivity becomes a dispatch constraint: a workspace can say which work may run on which rail, and restricted work never leaves the seats you name.
A hand-off parks the conversation for a teammate so they can continue where you were. Encrypted at rest, decrypted on pickup, expired after seven days or on withdraw. Off per workspace or per seat.
The spec body is read once and the band is recorded; the body is not kept. Off per workspace, in which case rows are sized from the title and history only.
The request, the why, done, the smallest version, in the requester's words. Stored on the row, encrypted, expiring with the row's retention. Sources stay links to where they already live.
Run it where your review says it has to run.
The proxy is a small service. Enterprise workspaces run it (and the record, and the connector) in their own account or region on their own keys, with our control plane seeing only what the record needs. Identity comes through WorkOS: SSO, SCIM, MFA and an admin portal, one connection, nothing built by hand.
Platform keys stay in your vault. The proxy holds them; the control plane never does.
Every policy decision, grant and admin action lands in the audit log, visible to the person it concerns.
Ed25519 with the workspace's key. Verified locally with the public key; nothing to trust us for.
Uninstall removes every trace from the laptop. You keep every row. They are yours.
Our own coding agent. A gateway. Model access.
An enterprise will run several agents on several platforms. The layer that dispatches across them and keeps one set of books has to be independent of all of them: no interest in where the work runs, no cut of what it routes. The customer's agents, models and keys are theirs. We are the layer that makes them one set of books.
Stream, don't store.