Measuring a team's AI work only works if the team trusts the measurement. So the boundary is architectural, not a policy promise: the collector is built so that raw content cannot reach the cloud at the default level.
Transcripts exist only on the engineer's machine. Every derived stat (tokens, tool health, prompt lengths, session titles) is computed locally by the uploader and shipped as a digest. The cloud never parses raw content at Level 1.
Access follows roles, enforced at the database layer. Admins read their org. Members read themselves. An engineer always sees their own data; the lead sees the team they run; nobody sees across org boundaries.
The collector ships as a public npm package. Read the source and see exactly which events it emits. No compiled blob, no hidden channel.
The installer writes plain hooks into your agent's settings file. Open the file and read what runs on each event. Delete the hooks and collection stops.
Digests are computed on the machine before upload. What travels is the result of the math, not the material it was computed from.
A measurement tool that engineers route around measures nothing. Level 1 is deliberately boring: timestamps and counts are enough to draw the lanes, compute leverage, and surface tool health, and they are not interesting to leak. Teams that want full session archives for review or training can opt into Level 2 with eyes open, on their own storage.