We keep the numbers. Never the prompts or the code.
Enterprises will not let their code or prompts be seen or kept. That is a precondition, not a feature, so the architecture says it precisely: stream, don't store; aggregates leave the laptop and raw data does not; the things that must carry content are opt-in, encrypted and expiring.
| surface | passes through | kept | never |
|---|---|---|---|
| the proxy | Requests to your own Claude or OpenAI seat, and back. | Tokens, model, cost, when, the seat, the decision at the wall. | Prompt or completion bodies. Repo contents. Tool output. |
| the record | The PR body's SLEDS-* lines, the ticket's fields, the brief. | Estimate, worth, actual, receipt, brief, per row. | The diff. The spec body, once the estimate is recorded. |
| the seat reader | Your own usage page, read as you. | Percent per bar, credits, the reset. | Anything else on the account. |
| the connector | What your AI sends to the tools: the ask, links, a stated worth. | The brief, as confirmed by you. Sources as links. | The rest of your conversation. |
| the tracker and Slack | What they already show you. | Nothing beyond what we wrote there. | Membership, permissions, message history. |
Three features carry content because they cannot work without it.
A hand-off parks the conversation for a teammate so they can continue where you were. Encrypted at rest, decrypted on pickup, expired after seven days or on withdraw. Off per workspace or per seat.
The spec body is read once and the band is recorded; the body is not kept. Off per workspace, in which case rows are sized from the ticket's title and history only.
The ask, the why, done, the smallest version, in the requester's words. Stored on the row, encrypted, expiring with the row's retention. Sources stay links to where they already live. Opt-in per workspace.
Sensitivity becomes a dispatch constraint: a workspace can say which work may run on which rail, and restricted work never leaves the seats you name.
Run it where your review says it has to run.
The proxy is a small service. Enterprise workspaces run it — and the record, and the connector — in their own account or region on their own keys, with our control plane seeing only what the record needs. Identity comes through WorkOS: SSO, SCIM, MFA and an admin portal, one connection, nothing built by hand. Self-host, in full →
Platform keys stay in your vault. The proxy holds them; the control plane never does.
Every policy decision, grant and admin action lands in the audit log, visible to the person it concerns.
Ed25519 with the workspace's key. Verified locally with the public key; nothing to trust us for.
Uninstall removes every trace from the laptop. Your tracker keeps the rows we wrote. They are yours.
Our own coding agent. A tracker with a head. A gateway. Model access. Anything that ranks people.
An enterprise will run several agents on several platforms. The layer that dispatches across them and keeps one set of books has to be independent of all of them: no interest in where the work runs, no cut of what it routes, no system of record taken by force. The customer's agents, models, keys and trackers are theirs. We are the layer that makes them one set of books.